Digital power grid security situation awareness method and system based on selective convolutional network

Abstract

The invention discloses a digital power grid security situation awareness method and system based on a selective convolutional network, and relates to the technical field of asset security management and control, and the method comprises the steps: collecting the multivariate heterogeneous data of the operation of a digital power grid through a sensor, and carrying out the preprocessing; performing multi-scale feature extraction on the preprocessed data by adopting a selective convolutional network; inputting the extracted multi-scale features into a secondary classification model for fault risk judgment and classification; and performing time sequence modeling on the classification result and the multi-scale features in combination with a time domain convolutional network, and predicting the future operation situation and potential risk of the digital power grid. According to the method, the selective convolutional network and the selective time domain convolutional network are improved, so that the problems of low classification precision and limited time sequence modeling capability caused by insufficient multi-source heterogeneous data feature extraction capability and data imbalance are technically solved; the method achieves the effects of enhancing the feature extraction precision, improving the minority class sample recognition capability, and optimizing the complex time sequence feature modeling and situation prediction precision.

Description

Technical Field

[0001] The present invention relates to the technical field of asset security management and control, and specifically to a digital power grid security situation awareness method and system based on a selective convolutional network. Background Art

[0002] As the core technology of modern power systems, digital grids are developing rapidly around the world. It is a new type of network that improves the efficiency and safety of power system operation by combining digitization, informatization and power management. The main feature of digital grids is to use Internet technology to integrate traditional power facilities with modern information processing methods to build a power operation system with real-time perception, intelligent analysis and efficient control. In this new type of power grid, every node, device, and even user becomes a data generation point or management point in the power network. Through the coordinated application of sensor networks, edge computing, cloud computing and big data analysis technologies, digital grids have realized dynamic monitoring and optimized management of the entire life cycle of electricity from production to consumption. However, with the rapid development of digital grid technology, its security issues have become increasingly prominent. The traditional power system operation and management model cannot adapt to this highly interconnected and dynamically changing complex system. It is urgent to introduce more intelligent and dynamic security situation awareness technology to ensure the stable and efficient operation of the digital grid.

[0003] The core function of the digital grid is to achieve dynamic management and optimization of the entire power system by fully sensing the operating status of the power grid. Among them, real-time monitoring and status detection functions are the basis of the digital grid, relying on sensors and data acquisition systems to accurately monitor the status of various links such as power generation, transmission, and distribution. The digital grid also uses fault prediction and diagnosis functions to provide early warning of possible equipment failures to avoid sudden interruptions in the power system. In addition, the load management and optimization scheduling functions of the digital grid can adjust power distribution according to real-time needs, improve resource utilization efficiency, and reduce energy waste. The intelligent decision support function is a high-level embodiment of the digital grid. It integrates multi-dimensional data analysis to provide a scientific decision-making basis for grid scheduling, operation and maintenance. The effective implementation of these functions makes the digital grid an important foundation for ensuring the energy supply of modern society, but it also puts forward higher requirements for the safety and intelligent management of power grid operation.

[0004] Although digital grids have significant advantages in improving the efficiency and intelligence level of power systems, they also inevitably bring many security challenges. First, since digital grids are deeply dependent on Internet technology, their various devices and systems are exposed to the network environment, so they are extremely vulnerable to external hacker attacks. Once the core power facilities are invaded, it may cause large-scale power outages and even pose a threat to national security. Secondly, the amount of data generated by digital grids is huge, and the data sources are complex and heterogeneous, including equipment operation data, user demand data, network communication data, etc. This complex data environment makes real-time processing and security management difficult. Third, the real-time prediction of power grid situation is more difficult. The operating status of the power grid is not only affected by the performance of the equipment itself, but also closely related to external factors such as climate change and user demand. This high degree of dynamism and uncertainty poses a great challenge to traditional situation awareness methods. Finally, the reliability issues of a large number of sensors and devices in the digital grid also bring hidden dangers to the security of the overall system. Once a node fails or a false alarm occurs, it may cause the entire system to deviate from the situation. Therefore, it has become a top priority to improve the ability of digital grid security situation awareness.

[0005] The development of digital power grid security situation awareness technology has experienced a gradual evolution from traditional statistical analysis to machine learning. Traditional statistical analysis methods mainly analyze historical data and construct mathematical models to predict potential faults. Although these methods have certain effects in the early days, they are difficult to adapt to complex and dynamic data environments because their assumptions are too idealistic. For example, regression analysis and time series analysis often show prediction bias when facing multi-source heterogeneous data. In addition, knowledge-based reasoning methods, such as Markov chain models and Bayesian networks, infer the future state of the power grid by modeling the historical state of the power grid. Although these methods perform well in processing structured data, their computational complexity and generalization ability are limited when facing real-time data and unstructured information. Among the machine learning methods introduced in recent years, technologies such as BP neural network and RBF neural network have brought new breakthroughs to digital power grid situation awareness. These methods can extract fault modes by training historical data, thereby improving fault identification capabilities. However, these technologies still have certain limitations in practical applications, such as sensitivity to data imbalance and lack of comprehensive extraction capabilities for multi-dimensional features.

[0006] Although existing technologies have played a certain role in the security situation awareness of digital power grids, there are still many problems in the face of more complex application scenarios. First, insufficient feature extraction capabilities are one of the main bottlenecks of current technologies. Traditional models find it difficult to extract high-dimensional features with spatiotemporal correlations from complex multi-source data, resulting in insufficient accuracy of situation awareness. Secondly, most existing methods use fixed receptive fields, which cannot adapt to the dynamic changes in the operating status of the power grid. This single receptive field design cannot fully capture the multi-scale information of the data. In addition, the normal state accounts for the vast majority of power grid data, and the proportion of fault data is relatively small. This data imbalance problem further aggravates the difficulty of model training, resulting in poor fault prediction and classification effects. Finally, when processing time series data, existing situation prediction methods are prone to problems such as gradient explosion or disappearance, resulting in insufficient timeliness of prediction results. These deficiencies limit the performance and reliability of digital power grid security situation awareness systems. Summary of the invention

[0007] In view of the above-mentioned problems, the present invention is proposed.

[0008] Therefore, the technical problem solved by the present invention is: how to effectively perceive the security situation of the digital power grid in a complex multi-source heterogeneous data environment, accurately classify and predict fault risks, and overcome the problems of insufficient feature extraction capability, poor data imbalance processing effect, and low accuracy of dynamic situation prediction in the prior art.

[0009] In order to solve the above technical problems, the present invention provides the following technical solution: a digital power grid security situation awareness method based on a selective convolutional network, which comprises the following steps:

[0010] Use sensors to collect multivariate and heterogeneous data of digital power grid operation for preprocessing;

[0011] A selective convolutional network is used to extract multi-scale features from preprocessed data;

[0012] The extracted multi-scale features are input into the secondary classification model to judge the fault risk and classify it;

[0013] The classification results and multi-scale features are combined with the time domain convolutional network to perform time series modeling to predict the future operation status and potential risks of the digital power grid.

[0014] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the multivariate heterogeneous data collected by sensors for the operation of the digital power grid includes:

[0015] Log collectors are deployed on key devices and nodes of the digital grid to collect log information generated when the devices are running. The collectors serve device communication through system logs and obtain detailed information on device operation status, fault alarms, and performance indicators in real time.

[0016] The collected log data is sent to the central processing unit for processing via a secure transmission path, and encryption technology is used during the transmission process.

[0017] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the preprocessing is in the central processing unit, the data first enters the parsing and filtering module, cleans and classifies the log data, removes the redundant information, and extracts the core features related to the security situation of the power grid equipment, and the extracted features are sorted and stored;

[0018] The collected multivariate heterogeneous data exists in the form of network traffic, including discrete features and continuous features. The discrete features are digitized and converted into numerical forms for machine processing. The expression is:

[0019] X m =f(X cat ),f=X cat ->{0,1,2,...,n-1}

[0020] Where n is the number of network protocol classes, X cat is a discrete feature, f(x) is a mapping function, X m is a collection of certificate values;

[0021] For the discrete features in network traffic data, one-hot encoding is used to convert different IP addresses or protocol types into binary vectors;

[0022] In one-hot encoding, assume a categorical variable X has k different categories, and each category i corresponds to a category value X i , where i∈{1,2,…,k}, for each sample X, it is converted into a k-dimensional one-hot vector v. For a sample X=x i , the one-hot encoding vector v is expressed as:

[0023] v=[v1,v2,…,v k ]

[0024]

[0025] Among them, v j Represents the value of the jth element in vector v;

[0026] For the continuous features in the network traffic data, standardization or normalization methods are performed to scale the value range of the features to a suitable range and reduce the scale differences between the features.

[0027] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the use of selective convolutional network to extract multi-scale features from pre-processed data includes:

[0028] In the improved selective convolution unit, the multi-scale features of the input data are extracted in parallel through convolution kernels of different scales. Let the input feature map be X, with a size of H×W×C, and the input feature map U of each convolution kernel is k The calculation formula is:

[0029]

[0030] Among them, W k is the weight of k convolution kernels, M×N is the size of the convolution kernel, b k is the bias, i, j are the row and column indices of the feature map respectively;

[0031] Introduce the global average pooling operation, for each branch U k , global average pooling result S k The expression is:

[0032]

[0033] The weight W is generated by two layers of fully connected networks and activation functions k , the expression is:

[0034] W k =σ(W2·δ(W1·S k ))

[0035] Among them, σ is the Sigmoid activation function, δ is the ReLU activation function, W1 and W2 are the weight matrices of the fully connected layer;

[0036] The weight W k Branch feature graph U corresponding to the action k And perform weighted fusion, the expression is:

[0037]

[0038] Among them, V1 is a weighted integration of multi-scale features.

[0039] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the inputting of the extracted multi-scale features into the secondary classification model for fault risk judgment and classification includes:

[0040] Assume that the input data set is D = {(x i ,y i )}, where x i represents the input feature, y i Indicates the label, y i ∈{0, 1, ..., C};

[0041] Construct an attack identification model, the expression is:

[0042] F1(x)=Sigmoid(W attack ·x+b)

[0043] Among them, W attack is the classification weight, b is the bias;

[0044] The output F1(x) represents the probability that sample x belongs to the attack class. A new data set D is constructed for samples with predicted probability F1(x)>0.5 of the attack sample. attack ={(x i ,y i )|y i ≠0};

[0045] Construct an attack classification model, the expression is:

[0046] F2(x)=Softmax(W class ·x+b)

[0047] Among them, F2(x) is the probability distribution of the attack sample belonging to each attack type.

[0048] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the inputting of the extracted multi-scale features into the secondary classification model for fault risk judgment and classification also includes:

[0049] The situation value calculation model is constructed by using the state probability factor and attack influence factor. i It represents the probability of the occurrence of the i-th type of attack in the current time period, and its formula is:

[0050]

[0051] Among them, n i is the number of attack samples of type i, and N is the total number of samples;

[0052] Attack Impact Factor E i The expression for evaluating the confidentiality, integrity and availability of the i-th attack is:

[0053] E i =Ci +I i +A i

[0054]

[0055]

[0056] Among them, C i , I i , A i They represent the threat levels to confidentiality, integrity and availability respectively, i represents the amount of sensitive data leaked due to the i-th attack, T i represents the number of data tampering events caused by the i-th attack, T t Indicates the total number of data transfer events in the current time period, U i represents the effective service time or traffic proportion caused by the i-th attack, U t Indicates the total service time or traffic percentage to be processed;

[0057] The final situation value expression is:

[0058]

[0059] Among them, C is the number of network attack status types, P i represents the probability of the i-th attack occurring in the current time period, E i is the attack impact factor.

[0060] As a preferred solution of the digital power grid security situation awareness method based on selective convolutional network described in the present invention, wherein: the time domain convolutional network is combined to perform time series modeling on the classification results and multi-scale features to predict the future operation situation and potential risks of the digital power grid, including:

[0061] For each input sample X∈R T×C , where T is the time step, C is the number of feature channels, and the selective convolution branch extracts temporal features in parallel through dilated convolution kernels of different sizes. The calculation formula of dilated convolution is:

[0062]

[0063] Among them, t is the time step, k is the convolution kernel size, r is the expansion rate, w(i) is the convolution kernel weight, and x(tr·i) is the input feature;

[0064] Selective convolution dynamically assigns weights to each branch through a global weighting mechanism, expressed as:

[0065] W k=σ(W2·δ(W1·GAP(X)))

[0066] Among them, GAP(X) is the global average pooling, W1 and W2 are weight matrices, σ is the Sigmoid activation function, and δ is the ReLU activation function;

[0067] The input historical situation value sequence is feature extracted through the selective time domain convolutional network, and the future situation value is predicted using causal relationships. The expression is:

[0068]

[0069] Where N is the total number of all samples;

[0070] The situation values ​​are divided into training sets and test sets in chronological order and converted into the T×C input format. The selective time domain convolutional network is trained with the training set. The parameters are adjusted by the Adam optimization algorithm to minimize the error. The training objective function uses the mean square error, which is expressed as:

[0071]

[0072] Among them, y i and represent the true value and the predicted value respectively.

[0073] Another object of the present invention is to provide a digital power grid security situation awareness system based on a selective convolutional network, which can collect multi-dimensional heterogeneous data of the digital power grid in real time by deploying a variety of sensors, combine the selective convolutional network to perform multi-scale feature extraction, and then use classification models and time series modeling technology to judge the risk of power grid failure and predict the situation, thereby solving the technical defects of the prior art in insufficient processing of multi-source heterogeneous data, dynamic perception and limited forward-looking warning capabilities.

[0074] In order to solve the above technical problems, the present invention provides the following technical solutions: A digital power grid security situation awareness system based on a selective convolutional network, comprising: a multi-heterogeneous data acquisition and preprocessing module, a multi-scale feature extraction module, a classification and risk assessment module, and a time series modeling and situation prediction module;

[0075] The multi-heterogeneous data acquisition and preprocessing module collects key data of digital power grid operation by deploying sensors, transmits the data to the central processing unit, performs cleaning, classification and format standardization processing, eliminates redundant information, and extracts core features related to the security situation of the power grid;

[0076] The multi-scale feature extraction module uses a selective convolutional network to extract multi-dimensional features from pre-processed data by parallel processing of multi-scale convolution kernels;

[0077] The classification and risk assessment module inputs the multi-scale features into the secondary classification model to determine whether there is a fault risk, classify the specific fault type, and quantify the risk value of the current power grid security situation through the state probability factor and the attack impact factor;

[0078] The time series modeling and situation prediction module combines classification results and multi-scale features, uses time domain convolutional networks to build a time series model, and predicts the future operation situation and potential risks of the digital power grid.

[0079] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the digital power grid security situation awareness method based on a selective convolutional network are implemented as described above.

[0080] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the digital power grid security situation awareness method based on a selective convolutional network as described above.

[0081] Beneficial effects of the invention: The invention solves the problems of insufficient feature extraction capability of multi-source heterogeneous data, low classification accuracy caused by data imbalance, and limited time series modeling capability by improving selective convolutional networks and selective time domain convolutional networks, thereby achieving the effects of enhancing feature extraction accuracy, improving minority class sample recognition capability, optimizing complex time series feature modeling and situation prediction accuracy, and significantly improving the efficiency and reliability of digital power grid security situation awareness and prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0083] Figure 1 An overall flow chart of a digital power grid security situation awareness method based on a selective convolutional network provided in the first embodiment of the present invention;

[0084] Figure 2 A selective convolutional network model diagram in a digital power grid security situation awareness method based on a selective convolutional network provided in the first embodiment of the present invention;

[0085] Figure 3 A secondary classification combination model diagram of a digital power grid security situation awareness method based on a selective convolutional network provided in the first embodiment of the present invention;

[0086] Figure 4 A schematic diagram of the SKTCN structure in the digital power grid security situation awareness method based on selective convolutional network provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0087] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0088] Example 1, reference Figure 1 to Figure 4 According to an embodiment of the present invention, a digital power grid security situation awareness method based on a selective convolutional network is provided, comprising:

[0089] The data acquisition module in the digital power grid situational awareness model obtains the operating status information of power grid equipment in real time by integrating log data without making any changes to the physical structure or logical configuration of existing equipment, so it will not affect the normal operation of the power grid. The goal of this module is to efficiently and reliably integrate the operating log data while maintaining the normal operation of the equipment, and provide data support for subsequent deep learning model analysis. By deploying log collectors, configuring log transmission paths, and parsing and storing log information, the module achieves a comprehensive perception of the operating status of power grid equipment.

[0090] First, log collectors are deployed on key devices and nodes of the digital power grid to collect log information generated during device operation. The collectors can communicate with devices directly through system log services (such as Syslog or event logs) to obtain detailed information including device operating status, fault alarms, performance indicators, etc. in real time. This collection process is transparent to the device operating environment and will neither interfere with the normal operation of the device nor increase the device load.

[0091] The collected log data is sent to the central processing unit through a secure transmission path for further processing. Encryption technology is used during the transmission process to ensure the integrity and security of the data. In the central processing unit, the data first enters the parsing and filtering module, which is responsible for cleaning and classifying the log data, removing redundant information, and extracting core features related to the security status of power grid equipment, such as abnormal equipment behavior records, power grid node load information, etc. These extracted high-quality data are organized and stored, providing a solid data foundation for feature extraction and pattern analysis of subsequent deep learning models.

[0092] The log data integration module can effectively collect and process the operating status information of power grid equipment under non-invasive conditions, provide accurate and real-time data support for the digital power grid situation awareness system, and ensure the efficient operation and accurate analysis of the security situation awareness model.

[0093] In the model, the captured network traffic data needs to go through a sophisticated data preprocessing process to ensure that the data input into the Selective Kernel Network (SKNet) meets the format and quality requirements of the model. The following are the detailed steps of preprocessing, including digitization, one-hot encoding, normalization, and dimensionality expansion.

[0094] Data digitization

[0095] The original network traffic data usually includes discrete features (such as protocol type, flag bit) and continuous features (such as packet size, traffic rate, etc.). First, the discrete features are digitized and converted into a numerical form that can be processed by the machine.

[0096] For discrete features X cat , construct a mapping function f(x) and map it to the certificate value set:

[0097] X m =f(X cat ),f=X cat ->{0,1,2,...,n-1}

[0098] Where n is the number of network protocol categories. For continuous features such as packet size, they directly enter the next step of normalization without additional processing.

[0099] One-hot encoding

[0100] For the discrete features in network traffic data (such as IP addresses, MAC addresses, network protocol types, etc.), one-hot encoding is used to convert different IP addresses or protocol types into binary vectors. As a commonly used encoding method in machine learning and data processing, it is mainly used to convert discrete data into numerical form so that it can be input into the model for training. In one-hot encoding, it is assumed that a categorical variable X has k different categories. Each category i corresponds to a category value X i , where i∈

[0101] {1,2,…,k}. For each value of sample X, we want to convert it into a k-dimensional one-hot vector v. For a sample X = x i , its one-hot encoding vector v can be defined as:

[0102] v=[v1,v2,…,v k]

[0103] in,

[0104]

[0105] Herev j Represents the value of the jth element in vector v. This is how the encoding of the data is obtained.

[0106] For the continuous features in the network traffic data (such as packet size, traffic length, time interval, etc.), appropriate retention and normalization are performed. And through standardization or normalization methods, the value range of these features is scaled to a suitable range to reduce the scale difference between features, so that the deep learning model can better learn the relationship between these features. The formula is as follows.

[0107]

[0108] Feature Dimension Expansion

[0109] The encoded non-continuous features are combined with the retained continuous features to form a complete feature vector as the input of the model. After the preprocessed data is formatted, all features are integrated into a feature vector with a length of 196. In order to meet the input requirements of the selective convolutional network, this one-dimensional vector is converted into a 14×14 two-dimensional matrix through the reshape operation. The conversion formula is as follows:

[0110] X reshaped = reshape(X processed ,(14,14))

[0111] Specifically, it can be described as filling the eigenvector of length 196 into a 14×14 matrix according to the row-first principle, and then finding the value of each matrix element corresponding to the preprocessed normalized eigenvalue. The resulting matrix is ​​a grayscale image, and each value is mapped to the grayscale value range [0, 1].

[0112] The 14×14 two-dimensional matrix is ​​regarded as a grayscale image, where each element x in the matrix i,j Mapped to grayscale value G i,j , the grayscale value range is [0, 255], and the final generated grayscale image will be used as the input of the selective convolutional network:

[0113] G i,j =x i,j ×255

[0114] By preprocessing the network traffic data, the network traffic characteristics of the digital power grid are effectively encoded and preserved.

[0115] The construction of the network security situation awareness model of the selective convolutional network (SKNet) mainly includes the background and optimization details of the model design, the proposal of the secondary classification model and its theoretical support, and the network security situation quantification and evaluation method. Through theoretical derivation, this system proposes an efficient network security situation awareness method for digital power grids based on the traditional selective convolutional network, which significantly improves the classification accuracy and robustness, especially showing superior performance in the processing of unbalanced data.

[0116] Reference Figure 2 The design of the improved selective convolutional network stems from the limitations of traditional convolutional neural networks (CNNs) in network security situation awareness. The inherent fixed receptive field characteristics of the CNN model make it impossible to dynamically adjust the feature extraction range according to the complexity and feature distribution of the input data, resulting in the omission of some key patterns. In addition, the heterogeneity and high-dimensional characteristics of network security data place higher requirements on traditional models. The selective convolutional network (SKNet) solves these problems to a certain extent through dynamic receptive fields and adaptive weight allocation, but there is a risk of information loss when multi-branch features are fused, and the original structure has relatively low training efficiency when processing network security data. To this end, this system improves the selective convolution unit of SKNet, designs a more efficient feature branch fusion mechanism, and introduces a lightweight structure to adapt to the needs of network security situation awareness.

[0117] In the improved selective convolution unit, feature extraction first extracts multi-scale features of the input data in parallel through convolution kernels of different scales (such as 3×3 and 5×5). Let the input feature map be X, with a size of H×W×C, and the input feature map U of each convolution kernel is k The calculation formula is:

[0118]

[0119] Among them, W k is the weight of k convolution kernels, M×N is the size of the convolution kernel, b k is the bias, i and j are the row and column indices of the feature map respectively. In order to reduce the computational complexity, the convolution kernel is further decomposed into multiple one-dimensional convolution operations, specifically:

[0120] U k =Conv(X,W k1 )*Conv(X,W k2 )

[0121] This operation significantly reduces the number of parameters and calculations while retaining the convolution kernel feature extraction capability. In order to fuse the extracted multi-scale features, this system introduces a global average pooling operation. k , its global average pooling result Sk The calculation is as follows:

[0122]

[0123] Next, the weight W is generated through two layers of fully connected networks and activation functions k :

[0124] W k =σ(W2·δ(W1·S k ))

[0125] Among them, σ is the Sigmoid activation function, δ is the ReLU activation function, W1 and W2 are the weight matrices of the fully connected layer. Finally, the weight W k Act on the corresponding branch feature map U k And perform weighted fusion:

[0126]

[0127] The output feature V1 is a weighted integration of multi-scale features, which can more comprehensively capture the feature correlation of the input data.

[0128] To address the problem of extremely unbalanced attack type distribution in network security datasets, refer to Figure 3 This system proposes the design of a secondary classification model. The traditional single-stage classification method is difficult to effectively deal with the problem of too high a proportion of normal samples, which often leads to a low recall rate of the model for minority attack samples, affecting the overall performance. The secondary classification model decomposes the classification task into two steps: attack identification and attack classification through staged processing. The attack identification model is used to determine whether the input sample is an attack sample and reduce the interference of normal samples on attack classification; the attack classification model further classifies the screened attack samples in detail to determine the specific attack type.

[0129] Assume that the input data set is D = {(x i ,y i )}, where x i represents the input feature, y i Indicates the label, y i ∈{0, 1, ..., C}. First, construct the attack identification model F1(x):

[0130] F1(x)=Sigmoid(W attack ·x+b)

[0131] Among them, W attack is the classification weight, b is the bias. The output F1(x) represents the probability that sample x belongs to the attack class. A new dataset D is constructed for samples with predicted probability F1(x)>0.5 of the attack sample. attack ={(xi ,y i )|y i ≠0}, then build the attack classification model F2(x):

[0132] F2(x)=Softmax(W class ·x+b)

[0133] The input F2(x) is the probability distribution of the attack sample belonging to each attack type. Finally, through two-stage processing, the recognition accuracy of minority class samples is improved.

[0134] In terms of quantification and evaluation of network security situation, this system constructs a situation value calculation model through state probability factor and attack impact factor. i It represents the probability of the occurrence of the i-th type of attack in the current time period, and its formula is:

[0135]

[0136] Among them, n i is the number of attack samples of the i-th type, obtained by classifying the digital power grid traffic through the classification model F2(x), and N is the total number of samples. Attack impact factor E i Evaluate the impact of type i attacks on confidentiality, integrity, and availability:

[0137] E i =C i +I i +A i

[0138] Among them, C i , I i , A i They represent the threat levels to confidentiality, integrity and availability respectively. Confidentiality C i It can be expressed as:

[0139]

[0140] Among them, l i Represents the amount of sensitive data leaked by the i-th attack, such as the number of bytes and characters. i It can be expressed as:

[0141]

[0142] Among them, T i represents the number of data tampering events caused by the i-th attack, such as packet verification errors or file modification times, T t Indicates the total number of data transmission events in the current time period, such as the total number of data packets. i It can be expressed as:

[0143]

[0144] Among them, U i Indicates the effective service time or traffic ratio caused by the i-th attack, such as the number of normal requests processed, U t Indicates the total service time or traffic percentage that should be processed, such as the total number of requests planned to be processed. The final situation value is calculated as:

[0145]

[0146] Where C is the number of network attack status types.

[0147] Through model testing, the system model performs better than traditional models in traffic classification, especially under unbalanced data. The improved SKNet model and secondary classification strategy show higher accuracy, robustness and efficiency when processing complex network security data.

[0148] Compared with long short-term memory neural networks, time-domain convolutional neural networks have the characteristics of parallelism, flexible receptive fields, and stable gradients. When dealing with time series problems, they have the advantages of short training time and high accuracy. However, due to the complex changes in network security situations and the rapid changes over time, the residual connection of the time-domain convolutional network fuses the original time series data with the feature data, which may cause large time delays in the prediction results or low prediction accuracy. In order to solve the problem of delayed prediction results in the field of network security situation prediction of the time-domain convolutional network, this system integrates the idea of ​​selective convolutional network with it and designs a selective time-domain convolution residual block (SKResidual Block), which can show better results in the field of network security situation awareness of digital power grids.

[0149] Reference Figure 4 In the design of the Selective Temporal Convolutional Network (SKTCN), the advantages of the Selective Convolutional Network (SKNet) and the Temporal Convolutional Network (TCN) are combined to propose a Selective Temporal Convolution Residual Block. This network structure can effectively extract temporal features in network security data through a dynamic receptive field while maintaining efficient parallelism and model stability. In SKTCN, the residual block is the basic unit, and its core is to model multi-scale temporal features through selective convolution branches and causal dilated convolution branches.

[0150] For each input sample X∈R T×C , where T is the time step and C is the number of feature channels), the selective convolution branch extracts temporal features in parallel through dilated convolution kernels of different sizes. The calculation formula for dilated convolution is:

[0151]

[0152] Among them, t is the time step, k is the convolution kernel size, r is the dilation rate, w(i) is the convolution kernel weight, and x(tr·i) is the input feature.

[0153] Dilated convolution can reduce the amount of computation while maintaining a large receptive field, and extract multi-scale temporal patterns through a combination of different dilation rates. Selective convolution dynamically assigns weights to each branch through a global weighting mechanism to enhance the expressiveness of key features. The weight calculation formula is:

[0154] W k =σ(W2·δ(W1·GAP(X)))

[0155] Among them, GAP(X) is the global average pooling, W1 and W2 are weight matrices, σ is the Sigmoid activation function, and δ is the ReLU activation function. Through the above calculation, the weight matrix W k It is used for weighted convolution output and finally fuses the feature maps of each branch to generate a unified temporal feature representation.

[0156] In the process of network security situation prediction, the input historical situation value sequence is firstly extracted through the selective time domain convolutional network, and the future situation value is predicted by using the causal relationship. The specific steps of prediction are as follows:

[0157] First, calculate the situation value and construct the data set. According to the situation quantification index defined above, use the following formula to calculate the current situation value V3 of the digital power grid:

[0158]

[0159] Where N is the total number of all samples (including the sum of samples of all attack types). The situation values ​​are divided into training sets and test sets in chronological order and converted into the T×C input format to adapt to the SKTCN model.

[0160] The SKTCN is trained using the training set, and the model adjusts parameters through the Adam optimization algorithm to minimize the error. The training objective function uses the mean square error (MSE):

[0161]

[0162] Among them, y i and Represent the true value and predicted value respectively. Finally, the test set is input into the trained model to generate a predicted value sequence, which is compared with the true situation value.

[0163] It is further explained that:

[0164] V2 is a classification model, C is the total number of attack types, and pi and ei are statistics based on different attack types.

[0165] V3 is a regression prediction model, N is the total number of samples in the time series, and pi and ei are based on the data trends within the time window.

[0166] The inputs of these two models are different, one is the attack traffic data, and the other is the situation value of the attack traffic time series. They correspond to the classifier to realize attack sample identification and classification, and the sktcn time series prediction model.

[0167] Use V1 as the input of V2, and then use several V2s as the input of V3 for calculation.

[0168] It is further explained that:

[0169] The situational awareness system created by the present invention has significant structural differences from the above-mentioned similar products, which are mainly reflected in the breadth and depth of information collection, the dynamics and efficiency of data fusion, and the intelligence and predictive capabilities of situational awareness.

[0170] First, at the information collection layer, the system of the present invention not only relies on traditional log sensors, but also integrates multiple data sources, including environmental monitoring data, equipment behavior logs, user load data, and external network threat intelligence. This integration of multi-source data makes the collection scope more comprehensive and can more accurately reflect the overall picture of the operation of the digital power grid. In addition, the system introduces a real-time data verification and repair mechanism in the collection process. By collecting and verifying at the same time, it effectively reduces the impact of data noise and missing data, and improves data quality from the source. In contrast, similar products rely more on a single data source, with narrow data coverage and large quality fluctuations, and cannot provide comprehensive and reliable basic data for situational awareness.

[0171] Secondly, in the multi-source data fusion layer, the system of the present invention realizes dynamic feature extraction of multi-source heterogeneous data by introducing the Selective Kernel Network (SKNet). SKNet can dynamically adjust the receptive field according to the characteristics of the input data and extract multi-scale features, especially in high-dimensional, unstructured data processing, it can better capture key patterns and spatiotemporal correlations. This dynamic feature extraction capability is significantly better than the feature extraction methods based on fixed rules or static models in similar products. The system also improves the efficiency of data fusion through distributed computing technology, overcoming the performance bottleneck of traditional systems in large-scale data processing.

[0172] The most significant difference is in the situational awareness layer. Based on the traditional deep neural network, the system of the present invention integrates the selective convolutional network (SKNet) and the selective time-domain convolutional network (SKTCN), and realizes the refined feature extraction and trend prediction of power grid data through the dynamic receptive field. In particular, through the modeling of time series features by SKTCN, the system can not only accurately evaluate the current situation, but also predict the trend of future situations, realizing the transformation from passive defense to active early warning. The situational awareness function of similar products is usually limited to the evaluation of the current state and lacks the forward-looking prediction ability of future risks. In addition, by designing a secondary classification model, the system first identifies the fault and then refines the classification of specific fault types, which significantly alleviates the impact of power grid data imbalance on model training. Similar products mostly use single-stage classification models, which easily lead to low recognition rates for a few fault types.

[0173] Finally, in terms of system robustness, the present invention significantly improves the stability of the system in the face of abnormal or noisy data by introducing residual structures and noise filtering mechanisms. Combined with the data weighting strategy based on the attention mechanism, the system can still maintain a high evaluation and prediction accuracy when the data is incomplete or of low quality. Similar products are prone to a significant drop in performance when the data is abnormal.

[0174] To sum up, the situational awareness system created by the present invention has significant advantages over similar products in terms of the comprehensiveness of information collection, the dynamics and efficiency of data fusion, and the intelligence, robustness and predictive ability of situational awareness, and can more comprehensively meet the needs of digital power grid security management.

[0175] Embodiment 2 is an embodiment of the present invention, which provides a system for a digital power grid security situation awareness method based on a selective convolutional network, including: a multivariate heterogeneous data acquisition and preprocessing module, a multi-scale feature extraction module, a classification and risk assessment module, and a time series modeling and situation prediction module;

[0176] The multi-heterogeneous data acquisition and preprocessing module collects key data of digital power grid operation by deploying sensors, transmits the data to the central processing unit, performs cleaning, classification and format standardization processing, eliminates redundant information, and extracts core features related to the security situation of the power grid;

[0177] The multi-scale feature extraction module uses a selective convolutional network to extract multi-dimensional features from pre-processed data by parallel processing of multi-scale convolution kernels;

[0178] The classification and risk assessment module inputs the multi-scale features into the secondary classification model to determine whether there is a fault risk, classify the specific fault type, and quantify the risk value of the current power grid security situation through the state probability factor and the attack impact factor;

[0179] The time series modeling and situation prediction module combines the classification results and multi-scale features, uses the time domain convolutional network to build a time series model, and predicts the future operation situation and potential risks of the digital power grid.

[0180] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0181] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0182] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0183] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0184] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A digital power grid security situation awareness method based on selective convolutional network, characterized in that: include: Use sensors to collect multivariate and heterogeneous data of digital power grid operation for preprocessing; A selective convolutional network is used to extract multi-scale features from preprocessed data; The extracted multi-scale features are input into the secondary classification model to judge the fault risk and classify it; The classification results and multi-scale features are combined with the time domain convolutional network to perform time series modeling to predict the future operation status and potential risks of the digital power grid.

2. The digital power grid security situation awareness method based on selective convolutional network according to claim 1, characterized in that: The use of sensors to collect multivariate heterogeneous data on the operation of the digital power grid includes: Log collectors are deployed on key devices and nodes of the digital grid to collect log information generated when the devices are running. The collectors serve device communication through system logs and obtain detailed information on device operation status, fault alarms, and performance indicators in real time. The collected log data is sent to the central processing unit for processing via a secure transmission path, and encryption technology is used during the transmission process.

3. The digital power grid security situation awareness method based on selective convolutional network according to claim 2 is characterized in that: The preprocessing is in the central processing unit, the data first enters the parsing and filtering module, cleans and classifies the log data, removes redundant information, and extracts the core features related to the security situation of the power grid equipment, and the extracted features are sorted and stored; The collected multivariate heterogeneous data exists in the form of network traffic, including discrete features and continuous features. The discrete features are digitized and converted into numerical forms for machine processing. The expression is: X m =f(X cat ),f=X cat ->{0,1,2,…,n-1} Where n is the number of network protocol classes, X cat is a discrete feature, f(x) is a mapping function, X m is a collection of certificate values; For the discrete features in network traffic data, one-hot encoding is used to convert different IP addresses or protocol types into binary vectors; In one-hot encoding, assume a categorical variable X has k different categories, and each category i corresponds to a category value X i , where i∈{1, 2, ..., k}, for each sample X, it is converted into a k-dimensional one-hot vector v. For a sample X=x i , the one-hot encoding vector v is expressed as: v=[v1,v2,…,v k ] Among them, v j Represents the value of the jth element in vector v; For the continuous features in the network traffic data, standardization or normalization methods are performed to scale the value range of the features to a suitable range and reduce the scale differences between the features.

4. The digital power grid security situation awareness method based on selective convolutional network according to claim 3 is characterized in that: The method of using a selective convolutional network to extract multi-scale features from pre-processed data includes: In the improved selective convolution unit, the multi-scale features of the input data are extracted in parallel through convolution kernels of different scales. Let the input feature map be X, with a size of H×W×C, and the input feature map U of each convolution kernel is k The calculation formula is: Among them, W k is the weight of k convolution kernels, M×N is the size of the convolution kernel, b k is the bias, i, j are the row and column indices of the feature map respectively; Introduce the global average pooling operation, for each branch U k , global average pooling result S k The expression is: The weight W is generated by two layers of fully connected networks and activation functions k , the expression is: W k =σ(W2·δ(W1·S k )) Among them, σ is the Sigmoid activation function, δ is the ReLU activation function, W1 and W2 are the weight matrices of the fully connected layer; The weight W k Branch feature graph U corresponding to the action k And perform weighted fusion, the expression is: Among them, V1 is a weighted integration of multi-scale features.

5. The digital power grid security situation awareness method based on selective convolutional network according to claim 4 is characterized in that: The step of inputting the extracted multi-scale features into the secondary classification model to judge the fault risk and classify the fault risk comprises: Assume that the input data set is D = {(x i ,y i )}, where x i represents the input feature, y i Indicates the label, y i ∈{0, 1, ..., C}; Construct an attack identification model, the expression is: F1(x)=Sigmoid(W attack ·x+b) Among them, W attack is the classification weight, b is the bias; The output F1(x) represents the probability that sample x belongs to the attack class. A new data set D is constructed for samples with predicted probability F1(x)>0.5 of the attack sample. attack ={(x i ,y i )|y i ≠0}; Construct an attack classification model, the expression is: F2(x)=Softmax(W class ·x+b) Among them, F2(x) is the probability distribution of the attack sample belonging to each attack type.

6. The digital power grid security situation awareness method based on selective convolutional network according to claim 5, characterized in that: The step of inputting the extracted multi-scale features into the secondary classification model to judge the fault risk and classify the fault risk also includes: The situation value calculation model is constructed by using the state probability factor and attack influence factor. i It represents the probability of the occurrence of the i-th type of attack in the current time period, and its formula is: Among them, n i is the number of attack samples of type i, and N is the total number of samples; Attack Impact Factor E i The expression for evaluating the confidentiality, integrity and availability of the i-th attack is: E i =C i +I i +A i Among them, C i , I i , A i They represent the threat levels to confidentiality, integrity and availability respectively, i represents the amount of sensitive data leaked due to the i-th attack, T i represents the number of data tampering events caused by the i-th attack, T t Indicates the total number of data transfer events in the current time period, U i represents the effective service time or traffic proportion caused by the i-th attack, U t Indicates the total service time or traffic percentage to be processed; The final situation value expression is: Among them, C is the number of network attack status types, P i represents the probability of the i-th attack occurring in the current time period, E i is the attack impact factor.

7. The digital power grid security situation awareness method based on selective convolutional network according to claim 6, characterized in that: The time domain convolutional network is combined with the classification results and multi-scale features to perform time series modeling to predict the future operation status and potential risks of the digital power grid, including: For each input sample X∈R T×C , where T is the time step, C is the number of feature channels, and the selective convolution branch extracts temporal features in parallel through dilated convolution kernels of different sizes. The calculation formula of dilated convolution is: Among them, t is the time step, k is the convolution kernel size, r is the expansion rate, w(i) is the convolution kernel weight, and x(tr·i) is the input feature; Selective convolution dynamically assigns weights to each branch through a global weighting mechanism, expressed as: W k =σ(W2·δ(W1·GAP(X))) Among them, GAP(X) is the global average pooling, W1 and W2 are weight matrices, σ is the Sigmoid activation function, and δ is the ReLU activation function; The input historical situation value sequence is feature extracted through the selective time domain convolutional network, and the future situation value is predicted using causal relationships. The expression is: Where N is the total number of all samples; The situation values ​​are divided into training sets and test sets in chronological order and converted into the T×C input format. The selective time domain convolutional network is trained with the training set. The parameters are adjusted by the Adam optimization algorithm to minimize the error. The training objective function uses the mean square error, which is expressed as: Among them, y i and represent the true value and the predicted value respectively.

8. A system using the digital power grid security situation awareness method based on a selective convolutional network as claimed in any one of claims 1 to 7, characterized in that: It includes multivariate heterogeneous data acquisition and preprocessing module, multi-scale feature extraction module, classification and risk assessment module, time series modeling and situation prediction module; The multi-heterogeneous data acquisition and preprocessing module collects key data of digital power grid operation by deploying sensors, transmits the data to the central processing unit, performs cleaning, classification and format standardization, eliminates redundant information, and extracts core features related to the security situation of the power grid; The multi-scale feature extraction module uses a selective convolutional network to extract multi-dimensional features from pre-processed data by parallel processing of multi-scale convolution kernels; The classification and risk assessment module inputs the multi-scale features into the secondary classification model to determine whether there is a fault risk, classify the specific fault type, and quantify the risk value of the current power grid security situation through the state probability factor and the attack impact factor; The time series modeling and situation prediction module combines classification results and multi-scale features, uses time domain convolutional networks to build a time series model, and predicts the future operation situation and potential risks of the digital power grid.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the digital power grid security situation awareness method based on a selective convolutional network described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the digital power grid security situation awareness method based on a selective convolutional network as described in any one of claims 1 to 7 are implemented.

Images