GOOSE protocol message anomaly detection method based on generative adversarial network model

Abstract

The invention discloses a GOOSE protocol message anomaly detection method based on a generative adversarial network model, and the model training method comprises the following steps: S1, obtaining a large number of network data messages of an electric power industrial control system, and carrying out the preprocessing of the data, including denoising and data cleaning; s2, performing feature extraction on the GOOSE data, including a protocol field value, a source / destination address, a timestamp, a state number, a serial number, an AppID application identifier, a TAG identification value and a data length, so as to establish a proper feature set; and S3, training the GOOSE protocol data feature set through a generative adversarial network model. And continuously adjusting model parameters and training according to a training judgment result during detection, and analyzing and detecting an abnormal GOOSE protocol message. According to the method, effective anomaly detection can be carried out on the existing GOOSE protocol network attack, and safe operation guarantee is provided for an electric power industrial control network system.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a GOOSE protocol message anomaly detection method based on a generative adversarial network model. Background Art

[0002] With the continuous development and widespread application of industrial control systems, the security of critical infrastructure such as power manufacturing has become increasingly important. Modern industrial control networks are increasingly adopting network-based communication protocols to achieve real-time monitoring and control. Among them, the GOOSE protocol, as part of the IEC61850 standard, is widely used for fast event message transmission in power systems. However, due to its high real-time performance and wide deployment, the GOOSE protocol has also become a potential target for network attackers.

[0003] Therefore, the anomaly detection method for the GOOSE protocol is crucial to improve the anomaly detection of the GOOSE protocol, ensure the robustness of the power system, and prevent potential threats. Summary of the invention

[0004] The present invention mainly solves the technical problem of the lack of a GOOSE protocol message detection method in the prior art, and provides a GOOSE protocol message anomaly detection method based on a generative adversarial network model with high accuracy and reliability.

[0005] The present invention aims to solve the above technical problems mainly through the following technical solutions: a GOOSE protocol message anomaly detection method based on a generative adversarial network model, including a model training process and a detection process, wherein the model training process is specifically: S1. Obtain the historical data message of the power industrial control system network, pre-process the historical data message, and ensure that the collected data is GOOSE protocol communication data; S2, extracting features from the pre-processed historical data messages and establishing a GOOSE protocol data feature set; S3. Use the GOOSE protocol data feature set to train the generative adversarial network model. Both the generator and the discriminator of the generative adversarial network model contain a temporal model gated recurrent unit. The processing process of the generator is: The random noise vector input to the generator input layer is mapped into a hidden vector representation, and then converted into an initial hidden state through an embedding layer or a fully connected layer. The initial hidden vector and the time series of the GOOSE protocol data feature set are then input into the generator gated recurrent unit layer. The generator gated recurrent unit layer generates the message features at the next moment according to the hidden state at the previous moment and the current input time series data. The message features generated by the generator gated recurrent unit layer are generated through the generator output layer to generate features similar to the real GOOSE message, while ensuring that the generated message has time series features; The processing process of the discriminator is as follows: a GOOSE message sequence is input into the discriminator input layer, and the output of the discriminator input layer enters the discriminator gated recurrent unit layer. The discriminator gated recurrent unit layer captures the change pattern of the message features in the sequence through the hidden state of each time step, and finally outputs a scalar value through the discriminator output layer, which represents the probability that the input message sequence is true; the discriminator can capture the message feature change pattern through the hidden state of each time step. The last hidden state indicates that the capture of the current message feature change pattern is completed (end), and finally a value will be output; The input to the discriminator includes the collected real GOOSE protocol data feature set and the fake message sequence generated by the generator; the discriminator is used to distinguish the fake messages generated by the generator from the real feature set messages. Through adversarial training, the fake message sequence generated by the generator through GRU becomes more and more realistic, and the time series features gradually approach the real GOOSE messages. The discriminator improves its ability to analyze time series through GRU and gradually optimizes its ability to detect anomalies. Through continuous iterative model training, the two compete with each other, and finally the generator is trained to generate realistic message sequences, and the discriminator accurately identifies abnormal messages.

[0006] This solution improves the generator and discriminator in the generative adversarial network model. In the improvement of the generator, the temporal model gated recurrent unit (GRU) is introduced into the generator so that it can take into account the time correlation when generating GOOSE messages. The generator not only generates a single message, but also generates temporal data streams that simulate the actual network, thereby generating more realistic normal GOOSE messages. This enables the model to better simulate normal communication behavior during training and improves the generation quality of the generator. The output layer of the generator is a fully connected layer or a deconvolution layer.

[0007] In the improvement of the discriminator, the discriminator can combine time series features, process a series of GOOSE messages through the structure of the gated recurrent unit (GRU), and make abnormal judgments based on the overall sequence. This allows the discriminator to judge abnormalities not only based on the characteristics of a single message, but also based on the change pattern of the message over a period of time. For example, when StNum (state number) or SqNum (sequence number) has abnormal jumps, the discriminator can capture these abnormal patterns. Through this timing-dependent discrimination mechanism, the discriminator can better identify messages that appear normal on the surface but have abnormal behavior over a period of time, thereby improving the recognition accuracy of abnormal GOOSE messages.

[0008] The generator generates a single message and a sequential data stream. The discriminator of the generative adversarial network also includes a sequential model gated recurrent unit. The discriminator determines anomalies based on the features of a single message and the message change model. The detection process is as follows: after continuously training the generator and the discriminator in the generative adversarial network model, the GOOSE protocol message to be detected is input into the discriminator of the trained generative adversarial network model to obtain anomaly detection results.

[0009] The discriminator trained by the generative adversarial network model can set a normal threshold to identify normal GOOSE protocol messages. If the discriminator judges that the authenticity of the communication message is lower than the normal threshold, the GOOSE protocol message is marked as abnormal. Finally, the GOOSE protocol message marked as abnormal is stored and recorded to realize GOOSE protocol anomaly detection and recording.

[0010] The generator of the generative adversarial network model not only generates a single message, but also generates a temporal data flow that simulates the actual network, thereby generating a more realistic normal GOOSE message. This enables the model to better simulate normal communication behavior during training and improve the generation quality of the generator.

[0011] The discriminator not only judges anomalies based on the characteristics of a single message, but also based on the change pattern of the message over a period of time. For example, when StNum (state number) or SqNum (sequence number) has abnormal jumps, the discriminator can capture these abnormal patterns. Through this timing-dependent discrimination mechanism, the discriminator can better identify those messages that appear normal on the surface but have abnormal behavior over a period of time, thereby improving the recognition accuracy of abnormal GOOSE messages.

[0012] Preferably, in step S3, the loss function of the generator is: , In the formula, w i is the weight of the i-th field; (G(z))i is the output of a specific field in the generated GOOSE message, E is the expectation of random noise z, that is, the average over all noise samples; z is random noise; pz is the probability distribution of random noise, and D is the discriminator; The loss function of the discriminator is: , In the formula, x is the real data sample, p data This is the actual message data distribution.

[0013] During training, the loss functions of the generator and discriminator are optimized, and a weighting mechanism for specific protocol features is added; and the normal threshold of the discriminator is adjusted and determined based on the results and distribution of the training data of the generative adversarial network model. If the discriminator judges the authenticity of the communication message to be lower than the normal threshold, the GOOSE protocol message is marked as abnormal.

[0014] Preferably, the weighting mechanism of adding specific protocol features to the loss function is specifically to give higher abnormal weights to changes in the state number and sequence number fields, such as the initial weight of all fields is 1, and the weights for the state number and sequence number can be set to a range of 3-5. This enables GAN to more sensitively identify abnormal behavior during training. Through the optimization of this loss function, the model can better adapt to the complexity of the GOOSE protocol.

[0015] Preferably, in step S1, preprocessing the historical data message includes data denoising and data cleaning: Data denoising: Check and analyze pcap (Packet Capture, data packet capture, pcap file contains the contents of captured protocol communication data packets) data communication messages, filter them according to the GOOSE protocol flag Type 0x88b8, and analyze the filtered messages to see if there are GOOSE protocol key fields, such as AppID (application identifier), StNum (status number), SqNum (sequence number), etc., and remove the messages without key fields; Data cleaning: After removing duplicate GOOSE protocol message information, invalid messages, abnormal messages and other noise data, the normal GOOSE protocol message data is saved.

[0016] Preferably, step S2 is specifically as follows: Several field information in the preprocessed historical data message is extracted as features, including the protocol field value of the data packet, source MAC address, destination address (multicast address), timestamp, AppID (application identifier), TAG identification value, StNum (state number), SqNum (sequence number) and data length; in the process of information extraction, the timestamp of the GOOSE protocol message is combined as a feature set. The extracted features are combined with the timestamp of the corresponding message to establish the GOOSE protocol data feature set.

[0017] Preferably, the source of the historical data message of the power industrial control system network in step S1 is: Use the Wireshark network packet capture tool to capture a large amount (more than 10,000) of GOOSE protocol and other communication data in the power industrial control system. The communication data covers GOOSE messages in different devices, states and operation scenarios in the power industrial control system.

[0018] The substantial effect brought by the present invention is that the present invention can provide effective anomaly detection for the GOOSE protocol in the electric power industrial control system, by collecting a large number of normal GOOSE protocol messages and performing feature extraction on the data, by generating an adversarial network model training data feature set, analyzing and detecting abnormal GOOSE protocol messages, accurately distinguishing normal messages from potential abnormal messages, reducing false alarm rate and missed alarm rate, increasing the accuracy of anomaly detection, and ensuring that the electric power industrial control system has accuracy and reliability in detecting anomalies of the GOOSE protocol.

[0019] The present invention can generate the adaptability of the adversarial network model to enable it to continuously learn new normal behavior patterns, ensuring that the GOOSE communication protocol anomaly detection is dynamically adjusted as the power industry control network environment changes. It not only provides a new technical means for the security protection of the power industry control network, but also provides a strong guarantee for the security and reliability of key infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a training flow chart of a generative adversarial network model of the present invention. DETAILED DESCRIPTION

[0021] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0022] Embodiment: A GOOSE protocol message anomaly detection method based on a generative adversarial network model in this embodiment includes a model training process and a detection process. Figure 1 As shown in the figure, the model training process includes the following steps: Step 1: Obtain a large number of network data packets of the power industrial control system, pre-process the data, and ensure that the collected data is GOOSE protocol communication data; This embodiment uses the Wireshark network packet capture tool to capture a large amount of GOOSE protocol and other communication data in the power industrial control system. These data should cover GOOSE messages in different devices, states and operation scenarios in the power industrial control system.

[0023] Data preprocessing includes data denoising and data cleaning: (1) Data denoising: Check and analyze pcap data communication messages, filter them according to the GOOSE protocol flag Type 0x88b8, and analyze the GOOSE protocol key fields after filtering, such as AppID (application identifier), StNum (status number), SqNum (sequence number), etc., to ensure that the collected data are GOOSE protocol communication messages.

[0024] (2) Data cleaning: After removing duplicate GOOSE protocol message information, invalid messages, abnormal messages and other noise data, the normal GOOSE protocol message data is saved.

[0025] Step 2: Extract features from GOOSE data, including protocol field value, source MAC address, destination address (multicast address), timestamp, AppID (application identifier), TAG identifier value, StNum (state number), SqNum (sequence number), and data length, to establish a suitable feature set; Multiple fields of information in the filtered GOOSE protocol data are extracted as features, including the protocol field value of the data packet, source MAC address, destination address (multicast address), AppID (application identifier), TAG identification value, StNum (state number), SqNum (sequence number) and data length. GOOSE protocol messages have strong temporal characteristics, and more abundant protocol fields and time series features are input to the generator and discriminator. In the process of information extraction, the timestamp of the GOOSE protocol message is combined as a feature set, so that the GAN model can better capture the timing pattern in the normal communication message, thereby improving the model's ability to identify abnormal behavior.

[0026] A normal feature set is established based on the features extracted from the GOOSE protocol field information.

[0027] Step 3: Train the GOOSE protocol data feature set through the generative adversarial network model; A generative adversarial network (GAN) deep learning training model is selected, and the normal GOOSE protocol data feature set is put into the model for training. Through iterative training, the improved generator and discriminator in the model compete with each other. The messages generated by the generator become more and more like real GOOSE messages, while the discriminator becomes better at detecting abnormal GOOSE messages. The abnormal message information identified by the discriminator is recorded and stored.

[0028] This solution improves the generator and discriminator in the generative adversarial network model: In the improvement of the generator, the timing model gated recurrent unit (GRU) is introduced into the generator, so that it takes into account the time correlation when generating GOOSE messages. The generator not only generates a single message, but also generates a timing data flow that simulates the actual network, thereby generating a more realistic normal GOOSE message. This enables the model to better simulate normal communication behavior during training and improves the generation quality of the generator.

[0029] Input: The input of the generator is a random noise vector and feature set time series information. This random noise will be mapped into a latent vector representation. The randomness of the noise vector helps the generator generate different message sequences, but GRU will maintain the continuity between messages in the time dimension to ensure that the generated messages conform to the normal mode of the GOOSE protocol.

[0030] Embedding layer or fully connected layer: The random noise vector is converted into an initial hidden state through the embedding layer or the fully connected layer as the input of the GRU layer.

[0031] GRU layer: Add a GRU layer to the generator to process time series data. GRU generates a series of time-dependent GOOSE message sequences based on the initial hidden state and time step of the input. Each GRU unit generates the message features of the next moment based on the hidden state of the previous moment and the current input time series data.

[0032] Output layer: The output of the GRU layer passes through a fully connected layer or a deconvolution layer to generate features similar to those of real GOOSE messages (such as AppID, SqNum, StNum and other fields), while ensuring that the generated messages have time series characteristics.

[0033] Time series message generation: The generator generates GOOSE messages at multiple times through GRU. The fields such as SqNum and StNum between messages will increase in order according to the change of time steps.

[0034] The input to the discriminator includes the collected real GOOSE protocol data feature set and the fake message sequence generated by the generator; the discriminator is used to distinguish the fake messages generated by the generator from the real feature set messages. Through continuous iterative model training, the generator and the discriminator compete with each other, ultimately ensuring that the discriminator can correctly identify normal GOOSE protocol message data.

[0035] In the improvement of the discriminator, the discriminator can combine time series features, process a series of GOOSE messages through the structure of the gated recurrent unit (GRU), and make abnormal judgments based on the overall sequence. This allows the discriminator to judge abnormalities not only based on the characteristics of a single message, but also based on the change pattern of the message over a period of time. For example, when StNum (state number) or SqNum (sequence number) has abnormal jumps, the discriminator can capture these abnormal patterns. Through this timing-dependent discrimination mechanism, the discriminator can better identify messages that appear normal on the surface but have abnormal behavior over a period of time, thereby improving the recognition accuracy of abnormal GOOSE messages.

[0036] Input: The discriminator receives a GOOSE message sequence as input, each sequence contains message data of multiple time steps. Each message data includes multiple features, such as AppID, timestamp, SqNum, StNum, etc.

[0037] GRU layer: The GRU layer of the discriminator is responsible for processing the entire message sequence and capturing the changing pattern of message features in the sequence through the hidden state of each time step. For example, GRU can capture the continuous increase of SqNum or the jump abnormality of StNum.

[0038] Output layer: The last hidden state of GRU outputs a scalar value through the fully connected layer, which indicates the probability that the input message sequence is true. If this value is lower than the set threshold, the message sequence is considered abnormal.

[0039] The discriminator does not judge a single message individually, but based on the message change pattern of the entire time series. For example, in the GOOSE protocol, if SqNum or StNum jumps abnormally, the GRU layer of the discriminator will capture these abnormal time-related patterns. GRU can learn normal timing features based on normal message sequences, such as the sending interval of messages, the orderly increase of sequence numbers, etc. Abnormal message sequences often show abnormalities in these features (such as discontinuity of SqNum or inconsistent sending intervals), which will be captured by GRU and passed to the output layer of the discriminator.

[0040] Step 4: Continuously adjust model parameters and training according to the training and discrimination results, and analyze and detect abnormal GOOSE protocol messages.

[0041] The loss functions of the generator and discriminator are optimized, and a weighting mechanism for specific protocol features is added. For example, for changes in the StNum (state number) and SqNum (sequence number) fields, a higher abnormal weight is given, which enables GAN to more sensitively identify abnormal behavior during training. Through this optimization of the loss function, the model can better adapt to the complexity of the GOOSE protocol.

[0042] In the loss function, a weighting mechanism can be introduced for specific protocol fields such as StNum (state number) and SqNum (sequence number), so that the generator pays more attention to the correctness of generating these fields, and the discriminator is also more sensitive to anomalies in these fields.

[0043] Define a weighted cross entropy loss, the improved generator loss function: , where w i is the weight of the i-th field; (G(z)) i It is the output of a specific field in the generated GOOSE message.

[0044] Similarly, the loss function of the discriminator can also be weighted and optimized for specific fields, so that the discriminator pays more attention to key fields when judging whether the generated message is true. The improved discriminator loss function is: , By assigning higher weights to key fields, the generator and discriminator can pay more attention to the temporal changes of fields such as SqNum and StNum in the GOOSE message, thereby generating and detecting anomalies more accurately.

[0045] In the detection process, the normal threshold of the discriminator is adjusted and determined according to the results and distribution of the training data of the generative adversarial network (GAN) model. If the discriminator judges that the authenticity of the communication message is lower than the normal threshold, the GOOSE protocol message is marked as abnormal.

[0046] The specific embodiments described herein are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.

[0047] Although the terms such as data message and gated cycle unit are used more frequently in this article, the possibility of using other terms is not excluded. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional restrictions is contrary to the spirit of the present invention.

Claims

1. A GOOSE protocol message anomaly detection method based on a generative adversarial network model, characterized in that: It includes a model training process and a detection process. The model training process is specifically as follows: S1. Obtain historical data messages from the power industrial control system network and pre-process the historical data messages; S2, extracting features from the pre-processed historical data messages and establishing a GOOSE protocol data feature set; S3. Use the GOOSE protocol data feature set to train the generative adversarial network model. Both the generator and the discriminator of the generative adversarial network model contain a temporal model gated recurrent unit. The processing process of the generator is: The random noise vector input to the generator input layer is mapped into a hidden vector representation, and then converted into an initial hidden state through an embedding layer or a fully connected layer. The initial hidden vector and the time series of the GOOSE protocol data feature set are then input into the generator gated recurrent unit layer. The generator gated recurrent unit layer generates the message features at the next moment according to the hidden state at the previous moment and the current input time series data. The message features generated by the generator gated recurrent unit layer are generated through the generator output layer to generate features similar to the real GOOSE message, while ensuring that the generated message has time series features; The processing process of the discriminator is as follows: a GOOSE message sequence is input into the discriminator input layer, and the output of the discriminator input layer enters the discriminator gated recurrent unit layer. The discriminator gated recurrent unit layer captures the change pattern of the message features in the sequence through the hidden state of each time step, and finally outputs a scalar value through the discriminator output layer, which represents the probability that the input message sequence is true; The input to the discriminator includes the collected real GOOSE protocol data feature set and the fake message sequence generated by the generator; The detection process is as follows: after continuously training the generator and the discriminator in the generative adversarial network model, the GOOSE protocol message to be detected is input into the discriminator of the trained generative adversarial network model to obtain anomaly detection results.

2. According to a GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, it is characterized in that: In step S3, the loss function of the generator is: ， In the formula, w i is the weight of the i-th field; (G(z)) i is the output of a specific field in the generated GOOSE message, E is the expectation of random noise z, that is, the average over all noise samples; z is random noise; p z is the probability distribution of random noise, D is the discriminator; The loss function of the discriminator is: ， In the formula, x is the real data sample, p data This is the actual message data distribution.

3. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 2, characterized in that: The weighting mechanism of adding specific protocol features to the loss function specifically gives higher abnormal weights to the timing changes of the status number and sequence number fields. For example, the initial weight of all fields is 1, and the weights for the status number and sequence number can be set in the range of 3-5.

4. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1 or 2, characterized in that: In step S1, the historical data message is preprocessed including data denoising and data cleaning: Data denoising: Check and analyze pcap data communication messages, filter them according to the GOOSE protocol flag Type 0x88b8, and analyze whether the filtered messages contain GOOSE protocol key fields. Delete the messages without key fields. Data cleaning: remove duplicate GOOSE protocol message information, invalid messages and abnormal messages, and save normal GOOSE protocol message data.

5. According to a GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, it is characterized in that: Step S2 is specifically as follows: Several field information in the preprocessed historical data message is extracted as features, and the field information includes the protocol field value, source MAC address, destination address, timestamp, application identifier, TAG identifier value, state number, sequence number and data length of the data packet; in the process of information extraction, the timestamp of the GOOSE protocol message is combined as a feature set. The extracted features are combined with the timestamp of the corresponding message to establish the GOOSE protocol data feature set.

6. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, characterized in that: The source of the historical data message of the power industrial control system network in step S1 is: Use the Wireshark network packet capture tool to capture more than 10,000 GOOSE protocol and other communication data in the power industrial control system. The communication data covers GOOSE messages in different devices, states and operation scenarios in the power industrial control system.

Images