Abnormal access behavior identification method and system of power key information infrastructure system

Abstract

The invention relates to the technical field of electric power monitoring, and provides an abnormal access behavior identification method and system for an electric power key information infrastructure system, and the method comprises the following steps: S1, collecting access log data, network flow data and system operation state data in the electric power key information infrastructure system, wherein the access log data comprises user identity information, access time and an access resource address; s2, cleaning, format conversion and feature extraction are performed on the collected data, noise and redundant information in the data are removed, the data in different formats are uniformly converted into formats suitable for analysis, and key features capable of reflecting access behavior features are extracted. By constructing an accurate normal access behavior model and adopting a scientific and reasonable deviation degree calculation method and a threshold judgment mechanism, normal access behaviors and abnormal access behaviors can be effectively distinguished, and the false alarm situation caused by fluctuation of the normal access behaviors is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of power monitoring, and particularly to a method and system for identifying abnormal access behaviors in a power critical information infrastructure system. Background Art

[0002] With the continuous improvement of the informatization and intelligence levels of power systems, power critical information infrastructure faces increasingly severe network security threats. Among them, abnormal access behaviors may come from external attackers or internal malicious users, and these abnormal behaviors may lead to serious consequences such as power system data leakage, system failures, and even large-scale power outages. Traditional security protection means often have problems such as low detection accuracy, high false alarm rates, and difficulty in adapting to specific business scenarios of power systems when facing complex and changeable abnormal access behaviors.

[0003] Therefore, we make improvements in this regard and propose a method and system for identifying abnormal access behaviors in a power critical information infrastructure system. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to improve the detection accuracy and reduce the false alarm rate in the power facility system, and further adapt to the specific business scenarios of the power system.

[0005] To achieve the above-mentioned invention object, the present invention provides a method for identifying abnormal access behaviors in a power critical information infrastructure system, including the following steps:

[0006] S1. Collect access log data, network traffic data, and system operation status data in the power critical information infrastructure system, where the access log data includes user identity information, access time, and access resource address;

[0007] S2. Clean, format-convert, and extract features from the collected data, remove noise and redundant information in the data, uniformly convert data in different formats into a format suitable for analysis, and extract key features that can reflect access behavior characteristics;

[0008] S3. Build a normal access behavior model based on the normal business access patterns and historical data of the power critical information infrastructure system;

[0009] S4. Input the access behavior data to be detected into the normal access behavior model, calculate the deviation degree of the access behavior from the normal model, and determine whether the access behavior is an abnormal access behavior according to a preset threshold;

[0010] S5. When it is determined that the access behavior is an abnormal access behavior, generate an alarm message and send it to the power system security monitoring center, and the alarm message includes relevant detailed information about the abnormal access behavior.

[0011] Preferably, in the step S2, the data processing includes the following steps;

[0012] S21. Count the number of accesses to the resources of the power key information infrastructure system by a specific user or a specific IP address within a unit time;

[0013] S22. Calculate the time interval between two adjacent access operations and count the distribution of different time intervals;

[0014] S23. Count the total network traffic data within a single access session or a unit time;

[0015] S24. Determine the depth level of the accessed resources according to the directory hierarchy of the accessed resources;

[0016] S25. Analyze the change of the system resource utilization rate when the access behavior occurs and the impact on the operation of key processes.

[0017] Preferably, in the step S3, the behavior modeling includes the following steps:

[0018] S31. Set up a sample training set , where, represents the feature vector of the th sample;

[0019] S32. Considering the particularity of the power system data, an improved SVM objective function introduces a weight factor to balance the influence of access behavior characteristics and power system operation characteristics, then there is , where, is the normal vector of the hyperplane, is the th element in the vector , is half of the square of the two-norm of the vector , that is , is the square of the two-norm of the weight vector part corresponding to the characteristics related to the power system operation calculated separately, is the intercept of the hyperplane, which is used to determine the position of the hyperplane in the feature space;

[0020] S33. Introduce the Lagrange multiplier , and transform the original problem into a dual problem, then there is , and obtain the value of ;

[0021] S34. After solving , calculate the values of and , then there is , , so as to determine the normal access behavior model and construct the normal access behavior model.

[0022] Preferably, in step S4, the anomaly detection includes the following steps;

[0023] S41. Invoke the pre-constructed normal access behavior model and load the model so that it can be used to detect the received data;

[0024] S42. Input the received access behavior data to be detected into the normal access behavior model, and calculate the deviation degree of the access behavior from the normal model , then there is , where is the number of features, and are the values of the data to be detected and the center of the normal model on the th feature respectively;

[0025] S43. Compare the deviation degree value obtained by the deviation degree calculation unit with a preset threshold, and judge whether the access behavior is an abnormal access behavior according to the preset threshold;

[0026] S44. Output the result of the anomaly detection, and the result output unit transmits this information to the alarm module or other relevant system modules for further processing or recording.

[0027] An abnormal access behavior recognition system for a power critical information infrastructure system, which is applied to the abnormal access behavior recognition method for a power critical information infrastructure system described in any one of the above, includes:

[0028] A data acquisition module, which is used to acquire access log data, network traffic data and system operation status data in the power critical information infrastructure system;

[0029] A data preprocessing module, connected to the data acquisition module, cleans, converts the format and extracts features from the acquired data, removes noise and redundant information in the data, uniformly converts data in different formats into a format suitable for analysis, and extracts key features that can reflect access behavior characteristics;

[0030] A behavior modeling module, connected to the data preprocessing module, constructs a normal access behavior model based on the normal business access mode and historical data of the power critical information infrastructure system;

[0031] An anomaly detection module, connected to the behavior modeling module, inputs the access behavior data to be detected into the normal access behavior model, calculates the deviation degree of the access behavior from the normal model, and judges whether the access behavior is an abnormal access behavior according to a preset threshold;

[0032] An alarm module, connected to the abnormal detection module, generates alarm information and sends it to the power system security monitoring center when an abnormal access behavior is determined.

[0033] Preferably, the data preprocessing module includes:

[0034] An access frequency feature extraction unit, used to count the number of accesses of specific users or specific IP addresses to the power key information infrastructure system resources within a unit time;

[0035] An access time interval feature extraction unit, used to calculate the time interval between two adjacent access operations and count the distribution of different time intervals;

[0036] A traffic size feature extraction unit, used to count the total network traffic data within a single access session or a unit time;

[0037] A resource access depth feature extraction unit, used to determine the access resource depth level according to the directory hierarchy of the accessed resources;

[0038] A system operation correlation feature extraction unit, used to analyze the change of system resource utilization rate when the access behavior occurs and the impact on the operation of key processes.

[0039] Preferably, the behavior modeling module includes:

[0040] A sample training unit, used to build a normal model only using normal access data and provide preprocessed training data for the model building unit;

[0041] A model building unit, used to select and initialize machine learning algorithms, build a model structure and define a loss function and an optimizer;

[0042] A model solving unit, used to calculate the parameter update amount, perform iterative training and evaluate and record the model performance;

[0043] A model determination unit, used to select the optimal model and store and deploy it.

[0044] Preferably, the abnormal detection module includes:

[0045] A model calling unit, used to call a pre-built normal access behavior model;

[0046] A deviation calculation unit, used to calculate the deviation degree between the access behavior data to be detected and the normal access behavior model;

[0047] An abnormal judgment unit, used to judge whether the access behavior is abnormal according to a preset threshold.

[0048] A result output unit for outputting result information of anomaly detection.

[0049] The method and system for identifying abnormal access behaviors of the power critical information infrastructure system provided by the present invention have the following beneficial effects:

[0050] 1. By adopting multi-source data collection, information related to access behaviors can be comprehensively obtained. Through data preprocessing steps, key features such as access frequency features, access time interval features, traffic size features, resource access depth features, and features related to the normal operation of the system are extracted. These rich features provide a basis for accurately identifying abnormal access behaviors. By constructing a normal access behavior model and using new data to update and optimize the model, this method enables the model to continuously adjust with the changes in the power system business and the dynamics of the network environment, adapting to different operation scenarios and access patterns.

[0051] 2. After determining the existence of abnormal access behaviors, they are further classified into specific abnormal behavior categories such as brute force attack type, malicious data stealing type, privilege abuse type, etc. according to the characteristic patterns of the abnormal behaviors. This helps security administrators understand the nature of abnormal behaviors more quickly and accurately, so as to take targeted security prevention and response measures. By constructing an accurate normal access behavior model and adopting a scientific and reasonable deviation degree calculation method and threshold judgment mechanism, it is possible to effectively distinguish normal access behaviors from abnormal access behaviors and reduce false alarms caused by fluctuations in normal access behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0053] Figure 1 It is the overall system schematic diagram of the method and system for identifying abnormal access behaviors of the power critical information infrastructure system provided by this application;

[0054] Figure 2 It is the system schematic diagram of the data preprocessing module of the method and system for identifying abnormal access behaviors of the power critical information infrastructure system provided by this application;

[0055] Figure 3 It is the system schematic diagram of the behavior modeling module of the method and system for identifying abnormal access behaviors of the power critical information infrastructure system provided by this application;

[0056] Figure 4Schematic diagram of the anomaly detection module system for the method and system for identifying abnormal access behaviors in the power critical information infrastructure system provided by this application. Detailed implementation manners

[0057] The following further describes in detail the specific implementation manners of the present invention in conjunction with the accompanying drawings of the specification and embodiments. The following embodiments are only used to illustrate the present invention, but cannot be used to limit the scope of the present invention.

[0058] As Figures 1 - 4 shown, this embodiment proposes a method for identifying abnormal access behaviors in a power critical information infrastructure system, including the following steps:

[0059] S1. Collect access log data, network traffic data, and system operation status data in the power critical information infrastructure system, where the access log data includes user identity information, access time, and access resource address;

[0060] S2. Clean, format-convert, and extract features from the collected data, remove noise and redundant information in the data, uniformly convert data in different formats into a format suitable for analysis, and extract key features that can reflect access behavior characteristics;

[0061] S3. Based on the normal business access patterns and historical data of the power critical information infrastructure system, construct a normal access behavior model;

[0062] S4. Input the access behavior data to be detected into the normal access behavior model, calculate the deviation degree of this access behavior from the normal model, and determine whether this access behavior is an abnormal access behavior according to a preset threshold;

[0063] S5. When it is determined to be an abnormal access behavior, generate an alarm message and send it to the power system security monitoring center. The alarm message includes relevant detailed information about the abnormal access behavior.

[0064] In this embodiment, in step S2, the data processing includes the following steps;

[0065] S21. Statistically count the number of accesses by a specific user or a specific IP address to the resources of the power critical information infrastructure system within a unit time;

[0066] S22. Calculate the time interval between two adjacent access operations and statistically count the distribution of different time intervals;

[0067] S23. Statistically count the total network traffic data within a single access session or within a unit time;

[0068] S24. Determine the depth level of the accessed resource according to the directory hierarchy of the accessed resource;

[0069] S25. Analyze the changes in the system resource utilization rate when the access behavior occurs and the impact on the operation of key processes.

[0070] In this embodiment, in step S3, the behavior modeling includes the following steps:

[0071] S31. Establish a sample training set , where represents the feature vector of the -th sample;

[0072] In the improved SVM objective function in S32, considering the particularity of power system data, a weight factor is introduced to balance the influence of access behavior characteristics and power system operation characteristics. Then there is , where is the normal vector of the hyperplane, is the -th element in the vector , is half of the square of the two-norm of the vector , that is , is the square of the two-norm of the weight vector part corresponding to the characteristics related to the power system operation calculated separately, is the intercept of the hyperplane, used to determine the position of the hyperplane in the feature space;

[0073] S33. Introduce the Lagrange multiplier , and transform the original problem into a dual problem. Then there is , and obtain the value of ;

[0074] S34. After solving , calculate the values of and . Then there is , , so as to determine the normal access behavior model and construct the normal access behavior model.

[0075] In this embodiment, in step S4, the anomaly detection includes the following steps;

[0076] S41. Call the pre-constructed normal access behavior model and load the model so that it can be used to detect the received data;

[0077] S42. Input the received access behavior data to be detected into the normal access behavior model and calculate the deviation degree of the access behavior from the normal model. Then there is , where is the number of features, and are the values of the data to be detected and the normal model center on the th feature respectively;

[0078] S43. Compare the deviation degree value obtained by the deviation degree calculation unit with a preset threshold, and judge whether the access behavior is an abnormal access behavior according to the preset threshold;

[0079] S44. Output the result of abnormal detection. The result output unit transmits this information to the alarm module or other relevant system modules for further processing or recording.

[0080] Specifically, by adopting multi-source data collection, information related to access behavior can be comprehensively obtained. Through data preprocessing steps, key features such as access frequency features, access time interval features, traffic size features, resource access depth features, and features related to the normal operation of the system are extracted. These rich features provide a basis for accurately identifying abnormal access behaviors. By constructing a normal access behavior model and being able to update and optimize the model with new data, this method enables the model to continuously adjust with the changes in the business of the power system and the dynamics of the network environment, and adapt to different operation scenarios and access patterns.

[0081] An abnormal access behavior recognition system for a power key information infrastructure system, which is applied to an abnormal access behavior recognition method for a power key information infrastructure system in any one of the above, includes:

[0082] A data collection module, which is used to collect access log data, network traffic data, and system operation status data in the power key information infrastructure system;

[0083] A data preprocessing module, which is connected to the data collection module, cleans, converts the format, and extracts features from the collected data, removes noise and redundant information in the data, uniformly converts data in different formats into a format suitable for analysis, and extracts key features that can reflect access behavior characteristics;

[0084] A behavior modeling module, which is connected to the data preprocessing module, and constructs a normal access behavior model based on the normal business access pattern and historical data of the power key information infrastructure system;

[0085] An abnormal detection module, which is connected to the behavior modeling module, inputs the access behavior data to be detected into the normal access behavior model, calculates the deviation degree of this access behavior from the normal model, and judges whether this access behavior is an abnormal access behavior according to a preset threshold;

[0086] The alarm module is connected to the abnormal access detection module. When it is determined that there is an abnormal access behavior, it generates alarm information and sends it to the power system security monitoring center.

[0087] In this embodiment, the data preprocessing module includes:

[0088] The access frequency feature extraction unit is used to count the number of accesses of specific users or specific IP addresses to the resources of the power critical information infrastructure system within a unit time;

[0089] The access time interval feature extraction unit is used to calculate the time interval between two adjacent access operations and count the distribution of different time intervals;

[0090] The traffic size feature extraction unit is used to count the total network traffic data within a single access session or a unit time;

[0091] The resource access depth feature extraction unit is used to determine the resource access depth level according to the directory hierarchy of the accessed resources;

[0092] The system operation correlation feature extraction unit is used to analyze the change of system resource utilization rate and the impact on the operation of key processes when the access behavior occurs.

[0093] In this embodiment, the behavior modeling module includes:

[0094] The sample training unit is used to build a normal model using only normal access data and provide preprocessed training data for the model building unit;

[0095] The model building unit is used to select and initialize machine learning algorithms, build model structures, and define loss functions and optimizers;

[0096] The model solving unit is used to calculate parameter update amounts, iteratively train, and evaluate and record model performance;

[0097] The model determination unit is used to select the optimal model and store and deploy it.

[0098] In this embodiment, the abnormal access detection module includes:

[0099] The model calling unit is used to call the pre-built normal access behavior model;

[0100] The deviation calculation unit is used to calculate the deviation degree between the access behavior data to be detected and the normal access behavior model;

[0101] The abnormal judgment unit is used to judge whether the access behavior is abnormal according to a preset threshold.

[0102] The result output unit is used to output the result information of abnormal access detection.

[0103] Specifically, after determining the existence of abnormal access behavior, it is further classified into specific abnormal behavior categories such as brute force attack, malicious data stealing, privilege abuse, etc. according to the characteristic patterns of the abnormal behavior. This helps security administrators understand the nature of the abnormal behavior more quickly and accurately, so as to take targeted security prevention and response measures. By constructing an accurate normal access behavior model and adopting a scientific and reasonable deviation degree calculation method and threshold judgment mechanism, it is possible to effectively distinguish normal access behavior from abnormal access behavior and reduce false alarms caused by fluctuations in normal access behavior.

[0104] The above embodiments are only used to illustrate the present invention, rather than limiting the present invention. Although the present invention has been described in detail with reference to the embodiments, those of ordinary skill in the art should understand that various combinations, modifications or equivalent replacements of the technical solutions of the present invention do not depart from the spirit and scope of the technical solutions of the present invention, and should all be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying abnormal access behavior of a power critical information infrastructure system, characterized in that: The following steps are involved: S1. Collect access log data, network traffic data and system operation status data in the power critical information infrastructure system, where the access log data includes user identity information, access time and access resource address; S2. Clean, convert, and extract features of the collected data to remove noise and redundant information from the data, convert data in different formats into a format suitable for analysis, and extract key features that can reflect access behavior characteristics; S3. Build a normal access behavior model based on the normal business access pattern and historical data of the power critical information infrastructure system; S4, inputting the access behavior data to be detected into the normal access behavior model, calculating the degree of deviation between the access behavior and the normal model, and determining whether the access behavior is an abnormal access behavior according to a preset threshold; S5. When it is determined to be an abnormal access behavior, an alarm message is generated and sent to the power system security monitoring center, and the alarm message includes relevant detailed information of the abnormal access behavior.

2. According to claim 1, a method for identifying abnormal access behavior of a power critical information infrastructure system is characterized in that: In step S2, data processing includes the following steps: S21. Count the number of visits to power critical information infrastructure system resources by specific users or specific IP addresses within a unit of time; S22, calculating the time interval between two adjacent access operations, and counting the distribution of different time intervals; S23, counting the total network traffic data of a single access session or a unit time; S24, determining the depth level of the accessed resources according to the directory hierarchy of the accessed resources; S25. Analyze the changes in system resource utilization when access behavior occurs and the impact on the operation of key processes.

3. The method for identifying abnormal access behavior of a power critical information infrastructure system according to claim 2 is characterized in that: In step S3, behavior modeling includes the following steps: S31. Set up sample training set ,in, Indicates The feature vector of samples; S32, Improved SVM objective function Considering the particularity of power system data, a weight factor is introduced To balance the impact of access behavior characteristics and power system operation characteristics, we have ,in, is the normal vector of the hyperplane, For vector The elements, To calculate the vector Half of the square of the second norm of , To calculate the squared norm of the weight vector corresponding to the power system operation related characteristics separately, is the intercept of the hyperplane, which is used to determine the position of the hyperplane in the feature space; S33. Introduction of Lagrange multipliers , transforming the original problem into a dual problem, we have , to obtain The value of S34, Solution Post-calculation and The value of , , thereby determining the normal access behavior model and constructing a normal access behavior model.

4. The method for identifying abnormal access behavior of a power critical information infrastructure system according to claim 3 is characterized in that: In step S4, the abnormality detection includes the following steps: S41, calling a pre-built normal access behavior model and loading the model so that it can be used to detect the received data; S42: Input the received access behavior data to be detected into the normal access behavior model, and calculate the degree of deviation between the access behavior and the normal model. , then ,in, is the number of features, and are the data to be tested and the center of the normal model in the The value of a feature; S43, comparing the deviation degree value obtained by the deviation degree calculation unit with a preset threshold value, and determining whether the access behavior is an abnormal access behavior according to the preset threshold value; S44: Output the results of the abnormality detection. The result output unit transmits this information to the alarm module or other related system modules for further processing or recording.

5. A system for identifying abnormal access behavior of a power critical information infrastructure system, applied to a method for identifying abnormal access behavior of a power critical information infrastructure system according to any one of claims 1 to 4, characterized in that: include: A data collection module is used to collect access log data, network traffic data, and system operation status data in the power critical information infrastructure system; The data preprocessing module is connected to the data acquisition module to clean, convert the format and extract features of the collected data, remove noise and redundant information in the data, convert data in different formats into a format suitable for analysis, and extract key features that can reflect the characteristics of access behavior; The behavior modeling module is connected to the data preprocessing module to build a normal access behavior model based on the normal business access pattern and historical data of the power critical information infrastructure system; The abnormality detection module is connected to the behavior modeling module, inputs the access behavior data to be detected into the normal access behavior model, calculates the degree of deviation between the access behavior and the normal model, and determines whether the access behavior is abnormal access behavior according to a preset threshold; The alarm module is connected to the anomaly detection module. When abnormal access behavior is determined, an alarm message is generated and sent to the power system security monitoring center.

6. The abnormal access behavior identification system for a power critical information infrastructure system according to claim 5 is characterized in that: The data preprocessing module comprises: An access frequency feature extraction unit is used to count the number of times a specific user or a specific IP address accesses the power critical information infrastructure system resources within a unit time; An access time interval feature extraction unit is used to calculate the time interval between two adjacent access operations and to count the distribution of different time intervals; A traffic size feature extraction unit is used to count the total network traffic data of a single access session or a unit of time; A resource access depth feature extraction unit, used to determine the depth level of the accessed resources according to the directory hierarchy of the accessed resources; The system operation correlation feature extraction unit is used to analyze the changes in system resource utilization when access behavior occurs and the impact on the operation of key processes.

7. The abnormal access behavior identification system for a power critical information infrastructure system according to claim 5 is characterized in that: The behavior modeling module includes: The sample training unit is used to build a normal model using only normal access data, and provides pre-processed training data for the model building unit; Model building unit, which is used to select and initialize machine learning algorithms, build model structures, and define loss functions and optimizers; Model solving unit, used to calculate parameter updates, iterative training, and evaluate and record model performance; The model determination unit is used to select the optimal model and store and deploy it.

8. The abnormal access behavior identification system for a power critical information infrastructure system according to claim 5 is characterized in that: The anomaly detection module comprises: A model calling unit is used to call a pre-built normal access behavior model; A deviation calculation unit, used to calculate the degree of deviation between the access behavior data to be detected and the normal access behavior model; The abnormality judgment unit is used to judge whether the access behavior is abnormal according to a preset threshold.

9. Result output unit, used to output the result information of anomaly detection.

Images