Power system network security threat monitoring and early warning method and device, power equipment, computer storage medium and program product

Abstract

The invention relates to a power system network security threat monitoring and early warning method and device, power equipment, a computer readable storage medium and a program product, and belongs to the field of power system network security. The method comprises the following steps: acquiring historical data and real-time data; obtaining first network feature data based on historical data, performing unsupervised learning training on the initial detection model, and taking abnormal data as second network feature data; marking the second network feature data as third network feature data; marking the first network feature data to obtain fourth network feature data to perform self-supervised learning training on the model, and obtaining first network attack features to construct a network attack feature library; performing semi-supervised learning training on the model based on the first network feature data and the third network feature data to obtain a detection model, and updating a network attack feature library; and detecting real-time data based on the detection model and the network attack feature library. The method can improve the accuracy of power system network security threat monitoring and early warning.

Description

Technical Field

[0001] The present application relates to the technical field of power system network security, and in particular, to a method, device, power equipment, computer-readable storage medium, and computer program product for monitoring and warning power system network security threats. Background Art

[0002] With the improvement of the digital and intelligent levels of power systems, power systems are exposed to increasingly complex network threats. For example, denial of service (DoS) attacks, malicious code injection, forged communication packets, etc. Therefore, it is necessary to monitor and warn power system network security threats. However, at present, the accuracy of power system network security threat monitoring and warning is not good. Summary of the Invention

[0003] Based on this, in view of the above technical problems, it is necessary to provide a method, device, power equipment, computer-readable storage medium, and computer program product for monitoring and warning power system network security threats to improve the accuracy of power system network threat monitoring and warning.

[0004] In a first aspect, the present application provides a method for monitoring and warning power system network security threats, including the following steps:

[0005] Based on the network security operation center of the power system, obtain the stored historical data and the real-time data generated by the network security devices in the power system and forwarded by the network security operation center;

[0006] Extract features from the historical data to obtain the first network feature data of the power system;

[0007] Input the first network feature data into a preset initial detection model for unsupervised learning training to determine the abnormal data in the first network feature data as the second network feature data; and label the second network feature data to obtain the third network feature data;

[0008] According to the preset first security rule of the network security device and the preset second security rule of the network security operation center, label the first network feature data to obtain the fourth network feature data of the power system;

[0009] Input the fourth network feature data into a preset initial detection model for self-supervised learning training to obtain the first network attack feature for the power system; based on the first network attack feature, construct a network attack feature library;

[0010] Input the first network feature data and the third network feature data into a preset initial detection model for semi-supervised learning training to obtain a trained detection model; and based on the semi-supervised learning training, obtain the second network attack feature for the power system; update the network attack feature library based on the second network attack feature;

[0011] Based on the detection model and the network attack feature library, perform network attack detection on real-time data to obtain the network security threat monitoring result for the power system.

[0012] In one embodiment, label the first network feature data according to the preset first security rule of the network security device and the preset second security rule of the network security operation center to obtain the fourth network feature data of the power system, including:

[0013] Determine the target security rule that matches the first network feature data from the preset first security rule of the network security device and the preset second security rule of the network security operation center;

[0014] Label the first network feature data according to the target security rule to obtain the fourth network feature data of the power system; the fourth network feature data of the power system includes the fourth network feature data labeled as normal, the fourth network feature data labeled as known threats, and the fourth network feature data labeled as potentially abnormal.

[0015] In one embodiment, determining the target security rule that matches the first network feature data from the preset first security rule of the network security device and the preset second security rule of the network security operation center includes: constructing a security rule library according to the preset first security rule of the network security device and the preset second security rule of the network security operation center; determining the target security rule from the security rule library; the method further includes: updating the rules of the security rule library according to each network attack feature in the network attack feature library; the rule update includes at least one of the following: determining the matching degree of each network attack feature and the security rules in the security rule library, combining the network attack features with the matching degree reaching the preset matching degree and the security rules corresponding to the network attack features with the matching degree reaching the preset matching degree to obtain new security rules; in the case of new network attack features, expanding the security rule library based on the new network attack features.

[0016] In one embodiment, the method further includes: updating the network attack feature library when at least one of the following conditions is met: there is a new network attack sample; the detection rate of network attacks decreases or the false alarm rate increases; the time since the last update of the network attack feature library reaches the preset time.

[0017] In one embodiment, feature extraction is performed on historical data to obtain first network feature data of the power system, including: preprocessing the historical data, where the preprocessing includes at least one of the following: cleaning redundancy, removing outliers, and unifying formats; performing feature extraction on the preprocessed historical data to obtain first network feature data of the power system.

[0018] In one embodiment, the method further includes: when the network security threat monitoring result indicates the existence of a cyber attack, determining a defense plan corresponding to the network security threat monitoring result and sending the defense plan to the network security operation center; when the network security threat monitoring result indicates the existence of a cyber attack and the existing cyber attack belongs to a preset type of cyber attack, sending an alarm to the network security operation center; and based on the network security operation center, triggering a preset measure corresponding to the network security threat monitoring result to perform emergency defense for the network security of the power system.

[0019] In a second aspect, the present application further provides a power system network security threat monitoring and warning device, including:

[0020] An acquisition module, configured to acquire stored historical data based on the network security operation center of the power system, and real-time data generated by network security devices in the power system and forwarded by the network security operation center;

[0021] A first training module, configured to perform feature extraction on historical data to obtain first network feature data of the power system; input the first network feature data into a preset initial detection model to perform unsupervised learning training to determine abnormal data in the first network feature data as second network feature data; and label the second network feature data to obtain third network feature data;

[0022] A second training module, configured to label the first network feature data according to a preset first security rule of the network security device and a preset second security rule of the network security operation center to obtain fourth network feature data of the power system; input the fourth network feature data into a preset initial detection model to perform self-supervised learning training to obtain a first network attack feature for the power system; and based on the first network attack feature, construct a network attack feature library;

[0023] A third training module, configured to input the first network feature data and the third network feature data into a preset initial detection model to perform semi-supervised learning training to obtain a trained detection model; and based on the semi-supervised learning training, obtain a second network attack feature for the power system; and based on the second network attack feature, update the network attack feature library;

[0024] The detection module is used to perform network attack detection on real-time data based on a detection model and a network attack feature library, obtain the monitoring results of network security threats for the power system, and transmit them to the network security operation center.

[0025] In a third aspect, the present application also provides a power device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of the network security threat monitoring and early warning method for the power system in the first aspect are implemented.

[0026] In a fourth aspect, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the network security threat monitoring and early warning method for the power system in the first aspect are implemented.

[0027] In a fifth aspect, the present application also provides a computer program product, including a computer program. When the computer program is executed by a processor, the steps of the network security threat monitoring and early warning method for the power system in the first aspect are implemented.

[0028] The above-mentioned network security threat monitoring and early warning method, device, power device, computer-readable storage medium and computer program product for the power system are based on obtaining historical data from the network security operation center of the power system, training a model required for network security detection of the power system through unsupervised learning, self-supervised learning and semi-supervised learning, obtaining a detection model and a network attack feature library, and performing network attack detection on the real-time data generated by the network security devices in the power system and forwarded by the network security operation center based on the detection model and the network attack feature library, which can improve the accuracy and efficiency of network security threat monitoring and early warning for the power system. Description of the Drawings

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for use in the description of the embodiments of the present application or related technologies. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0030] Figure 1 It is the first flowchart of the network security threat monitoring and early warning method for the power system in an embodiment;

[0031] Figure 2 It is the second flowchart of the network security threat monitoring and early warning method for the power system in an embodiment;

[0032] Figure 3It is the third flowchart of the power system network security threat monitoring and early warning method in an embodiment;

[0033] Figure 4 It is the fourth flowchart of the power system network security threat monitoring and early warning method in an embodiment;

[0034] Figure 5 It is the schematic flowchart of steps S31 to S32 of the power system network security threat monitoring and early warning method in an embodiment;

[0035] Figure 6 It is the schematic flowchart of step S33 of the power system network security threat monitoring and early warning method in an embodiment;

[0036] Figure 7 It is another schematic flowchart of step S33 of the power system network security threat monitoring and early warning method in an embodiment;

[0037] Figure 8 It is the overall schematic flowchart of the power system network security threat monitoring and early warning method in an embodiment;

[0038] Figure 9 It is another overall schematic flowchart of the power system network security threat monitoring and early warning method in an embodiment;

[0039] Figure 10 It is the internal schematic flowchart of the detection model in an embodiment;

[0040] Figure 11 It is the structural block diagram of the power system network security threat monitoring and early warning device in an embodiment;

[0041] Figure 12 It is the internal structure diagram of the power equipment in an embodiment. Detailed implementation manners

[0042] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. As used herein, the term "a plurality" may refer to two or more unless otherwise specified.

[0043] Existing deep learning model technologies often have relatively high requirements for data and environment configuration in practical applications:

[0044] First, deep learning models usually require a large amount of high-quality data for training. This data not only needs to have rich diversity but also requires fine preprocessing to ensure the effectiveness and accuracy of model training. Processes such as data collection, cleaning, and annotation usually require a large amount of time and labor costs. In addition, as the model scale continues to increase, the computational requirements for data storage and processing also increase significantly, making data storage, transmission, and management more complex and expensive.

[0045] Second, the deployment requirements of deep learning models have a complex environment. Their resource requirements are not only costly but also require professional technical personnel for configuration and maintenance. In addition, the deployment environment also requires appropriate software support, such as the configuration of deep learning frameworks (TensorFlow, PyTorch, etc.), operating systems, and related dependent libraries. This poses a significant technical challenge for those without relevant experience.

[0046] Moreover, since deep learning models usually involve large-scale data processing and complex algorithms, the model training and inference processes are not easily understood and intervened by non-professional personnel. If there are problems with the model, security personnel without sufficient experience often have difficulty quickly locating and fixing the problems.

[0047] Based on the above analysis, the embodiments of this application provide a method for monitoring and warning of network security threats in a power system, which can be applied to a power system. For example, it can be applied to devices in a network security operation center of a power system that can interact, such as a server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0048] In an exemplary embodiment, as Figure 1 shown, a method for monitoring and warning of network security threats in a power system is provided. Taking the method applied to a device in a network security operation center of a power system that can interact, such as a server, as an example, it includes the following steps S101 to S105:

[0049] Step S101: Based on the network security operation center of the power system, obtain the stored historical data and the real-time data generated by network security devices in the power system and forwarded by the network security operation center.

[0050] Among them, the network security operation center can be a dedicated operation center for the network security of the power system, which can be configured with corresponding network security management devices, such as servers, to monitor the operation of the power system network, etc.

[0051] Among them, the historical data can be the data related to the network security of the power system stored in the network security operation center of the power system. For example, the network traffic usage of the power system in the past month, etc.

[0052] Exemplarily, the power system can be a large-scale power system, which can involve multiple links such as power generation, power transmission, and power consumption. Correspondingly, multiple network security devices can be set up.

[0053] Exemplarily, the network security operation center can interact with the network security devices in the power system. For example, the network security operation center can obtain the real-time data of the network security devices in the power system and forward it, etc.

[0054] Step S102: Extract features from the historical data to obtain the first network feature data of the power system; input the first network feature data into a preset initial detection model for unsupervised learning training to determine the abnormal data in the first network feature data as the second network feature data; and label the second network feature data to obtain the third network feature data.

[0055] In some embodiments, the initial detection model can be an existing artificial intelligence model or a model obtained by making certain adjustments based on the existing model, such as a model adjusted according to the characteristics of the power system network itself. Exemplarily, the initial detection model can be a deep neural network model.

[0056] In some embodiments, the second network feature data can be labeled manually.

[0057] Step S103: Label the first network feature data according to the preset first security rule of the network security device and the preset second security rule of the network security operation center to obtain the fourth network feature data of the power system; input the fourth network feature data into a preset initial detection model for self-supervised learning training to obtain the first network attack feature for the power system; based on the first network attack feature, construct a network attack feature library.

[0058] Among them, the first network attack feature can be a feature used to represent the existence of a network security attack against the power system.

[0059] Exemplarily, the annotation of the first network feature data can be performed according to a preset first security rule and a preset second security rule. In some embodiments, since the annotation of the second network feature data is based on the preset first security rule and the preset second security rule, it can be automatically completed by designing a specific program. For example, the preset first security rule requires that the traffic used by device A in the power system within one day does not exceed 110 MB. If it exceeds 110 MB, it is considered that there is a network security problem. And the first network feature data represents that the traffic used by device A within one day is 500 MB. Therefore, the corresponding feature data can be automatically annotated as having a network security problem.

[0060] Since the annotation of the first network feature data is based on the preset first security rule and the preset second security rule and is automatically performed, without manually annotated labels, but automatically generating labels from the input data itself to guide the learning process of the model, self-supervised learning of the initial detection model can be achieved.

[0061] Step S104: Input the first network feature data and the third network feature data into a preset initial detection model for semi-supervised learning training to obtain a trained detection model; and based on the semi-supervised learning training, obtain the second network attack feature for the power system; update the network attack feature library based on the second network attack feature.

[0062] Step S105: Based on the detection model and the network attack feature library, perform network attack detection on the real-time data to obtain the network security threat monitoring result for the power system.

[0063] In some embodiments, network attack detection can be performed on the real-time data to achieve network security threat monitoring of the power system. By transmitting the network security threat monitoring result to the network security operation center, network security threat monitoring and early warning of the power system can be realized.

[0064] In this embodiment, based on obtaining historical data from the network security operation center of the power system, a model required for network security detection of the power system is trained through unsupervised learning, self-supervised learning, and semi-supervised learning to obtain a detection model and a network attack feature library. And based on the detection model and the network attack feature library, network attack detection is performed on the real-time data generated by the network security devices in the power system and forwarded by the network security operation center, which can improve the accuracy and efficiency of network security threat monitoring and early warning of the power system.

[0065] In one of the embodiments, the "annotating the first network feature data according to the preset first security rule of the network security device and the preset second security rule of the network security operation center to obtain the fourth network feature data of the power system" in the foregoing embodiment is asFigure 2 As shown, it may include steps S201 to S202:

[0066] Step S201: Determine a target security rule that matches the first network feature data from the preset first security rules of the network security device and the preset second security rules of the network security operation center.

[0067] Step S202: Annotate the first network feature data according to the target security rule to obtain the fourth network feature data of the power system; the fourth network feature data of the power system includes the fourth network feature data marked as normal, the fourth network feature data marked as known threats, and the fourth network feature data marked as potentially abnormal.

[0068] Exemplarily, the preset first security rules may include multiple specific security rules. Similarly, the preset second security rules may also include multiple specific security rules, and these security rules may correspond to different network feature data. In this regard, the target security rule that matches the first network feature data can be determined first, and then the annotation can be performed according to the target security rule.

[0069] In this embodiment, by first determining the target security rule that matches the first network feature data, and then more accurately annotating the first network feature data according to the target security rule, it is ensured that the fourth network feature data obtained by annotation is more accurate.

[0070] In one embodiment, the "determine a target security rule that matches the first network feature data from the preset first security rules of the network security device and the preset second security rules of the network security operation center" in the foregoing embodiment includes: constructing a security rule library according to the preset first security rules of the network security device and the preset second security rules of the network security operation center; determining the target security rule from the security rule library;

[0071] The network security threat monitoring and early warning method for the power system further includes: updating the rules of the security rule library according to each network attack feature in the network attack feature library; the rule update includes at least one of the following:

[0072] Determine the matching degree of each network attack feature and the security rules in the security rule library, combine the network attack features with the matching degree reaching the preset matching degree and the security rules corresponding to the network attack features with the matching degree reaching the preset matching degree to obtain new security rules;

[0073] In the case of the appearance of new network attack features, expand the security rule library based on the new network attack features.

[0074] In this embodiment, by constructing a security rule library and updating the security rule library in a timely manner - combining network attack features that reach a preset matching degree and the corresponding security rules of network attack features that reach a preset matching degree, and expanding the security rule library based on new network attack features, this can ensure the timeliness and accuracy of the security rule library, so as to obtain more accurate target security rules, in order to better serve the more accurate annotation of the first network feature data according to the target security rules.

[0075] In one embodiment, the power system network security threat monitoring and early warning method further includes: updating the network attack feature library when at least any one of the following conditions is met: there is a new network attack sample; the error between the model input data and the reconstructed data exceeds a threshold; the detection rate of network attacks decreases or the false alarm rate increases; the time since the last update of the network attack feature library reaches a preset time.

[0076] In this embodiment, when the above conditions such as the existence of a new network attack sample are met, the network attack feature library is updated, which can ensure the timeliness and accuracy of the security rule library, and this helps to improve the accuracy of power system network security detection.

[0077] In one embodiment, feature extraction is performed on historical data to obtain the first network feature data of the power system, including: preprocessing the historical data, and the preprocessing includes at least one of the following: cleaning redundancy, removing outliers, and unifying the format; performing feature extraction on the preprocessed historical data to obtain the first network feature data of the power system.

[0078] In this embodiment, by preprocessing the historical data, the data quality is improved to facilitate obtaining more accurate first network feature data.

[0079] In one embodiment, the power system network security threat monitoring and early warning method further includes: when the network security threat monitoring result indicates the existence of a network attack, determining a defense plan corresponding to the network security threat monitoring result and sending the defense plan to the network security operation center; when the network security threat monitoring result indicates the existence of a network attack and the existing network attack belongs to a preset network attack type, sending an alarm to the network security operation center; and triggering a preset measure corresponding to the network security threat monitoring result based on the network security operation center to perform emergency defense for the power system network security.

[0080] Among them, the preset network attack type can be a preset specific type of network attack, and this type may have a greater impact on the power system. Exemplarily, the preset network attack type can be determined manually and supports adjustments such as addition and deletion.

[0081] In some embodiments, in the case of detecting a specific type of cyber attack, the network security operation center can grant temporary management permissions to the detection model, that is, the detection model can, through the network security operation center, take preset measures corresponding to the network security threat monitoring results. For example, turn on the firewall, cut off the network connection of the corresponding device, cut off the power supply of the corresponding device, etc.

[0082] In this embodiment, based on the network security threat monitoring results, if there is a cyber attack, a corresponding defense plan is generated. When the cyber attack belongs to a preset type of cyber attack, an alarm is given and preset measures are taken to carry out emergency defense for the power system network security. This helps to ensure the network security of the power system.

[0083] In one embodiment, a method for monitoring the network security of a power system is provided. This method extracts and transforms features from the data source of the security operation center, combines deep learning strategies of unsupervised learning, self-supervised learning, and semi-supervised learning to capture and analyze network behavior features, and dynamically expands and updates the threat feature library to generate corresponding defense decisions. As Figures 3 to 10 , a related process schematic of the method for monitoring the network security of the power system is given. Among them, Figure 8 a possible overall process schematic of the method for monitoring and warning of network security threats in a power system is given; Figure 9 another possible overall process schematic of the method for monitoring and warning of network security threats in a power system is given; Figure 10 a possible internal process schematic of the detection model is given.

[0084] As Figure 3 shown, the method for monitoring the network security of the power system may include steps S31 to S34:

[0085] Step S31: Obtain local original data (i.e., historical data) according to the power network security operation center.

[0086] Among them, the power system network security operation center (Security Operations Center, SOC) can be a centralized facility for real-time monitoring, detection, analysis, and response to security incidents and threats in the power system network. By collecting network traffic, terminal devices, applications, and data of the power system in real time, various security devices and analysis tools are used to detect potential security threats and manage security incidents, such as IDS / IPS (IDS is Intrusion Detection System; IPS is Intrusion Prevention System), firewalls, SIEM (Security Information and Event Management) systems, etc.

[0087] In some embodiments, the power system network security operation center, as the network security command center of the power system, can integrate multiple security means for unified management and response.

[0088] Step S32: According to the original data of the power network security operation center, convert and unify the formats in different types of original data sources, and at the same time perform feature extraction and data partitioning to obtain network feature data.

[0089] As Figure 5 shown, the flow diagrams of steps S31 to S32 are given.

[0090] Step S33: Based on the network feature data, mine attack behavior patterns and features for expanding the threat feature library (i.e., the network attack feature library) and enhancing the deep learning model (i.e., the detection model), and construct targeted intrusion detection capabilities by deeply analyzing actual threat samples. As Figure 6 shown, the flow diagram of step S33 is given. As Figure 7 shown, another flow diagram of step S33 is given.

[0091] Step S34: Through the network attack feature library and the detection model, perform attack detection on real-time data, classify it into known attack types and unknown attack patterns, and generate a defense decision plan.

[0092] Exemplarily, the deep learning model can directly access the data pipeline of the security operation center through a streaming processing framework (such as Apache Kafka, a distributed stream processing platform, or Apache Flink, a stream processing framework), directly analyze real-time network traffic and log data, or import historical log data (such as security events, abnormal traffic) stored in the security operation center into the model for offline modeling and behavior analysis. This can greatly reduce the workload in the data integration process (most of the data preprocessing work has been completed in the security operation center). At the same time, the security operation center itself can also use the correlation analysis rules pre-established by security personnel to reduce false alarms, which can also effectively reduce the noise in the model learning process and improve the initial learning efficiency of the model.

[0093] For the detected risks, the deep learning model can generate a risk score for the threat (based on the model confidence). The security operation center combines this score with the scores of other systems (such as the scores of vulnerability scanners) and its own risk scores in the security operation center to formulate a priority response strategy.

[0094] In some embodiments, the detection results of the deep learning model can be displayed based on visualization tools in the security operation center (such as ELK Kibana, an analysis and visualization platform; Splunk Dashboard, a function in Splunk software for visualizing data), including the attack type, timeline, and scope of influence.

[0095] In some embodiments, the IP addresses and domain names detected by the deep learning model can be quickly correlated with an intelligence database (such as MITRE ATT&CK, a knowledge base and framework of adversarial tactics, techniques, and common sense for describing the behavior patterns of attackers in the field of network security; VirusTotal, an online virus, malware, and URL detection service), integrating the abnormal behaviors detected by the model into the overall attack path, identifying key nodes in the threat chain, and judging the source and intention of the attack.

[0096] In some embodiments, after the deep learning model detects an anomaly, through an API or script, the abnormal features detected by the model (such as IP addresses, domain names, protocol patterns) are dynamically pushed to the firewall or IPS rule engine to update the rules in real time according to the existing situation, so as to improve the pertinence and real-time nature of the rules.

[0097] In some embodiments, after the detection results of the model are sent to the SIEM (Security Information and Event Management) platform, they can be correlated with the alarms of other devices for analysis, eliminating false alarms and redundant alerts, improving the model detection ability in continuous iterative learning, and effectively eliminating the problem of high false alarm rates in traditional security solutions.

[0098] In one embodiment, a method for monitoring and warning of power system network security threats is provided. The method includes the following steps S31 to S34:

[0099] Step S31: Obtain local original data (i.e., historical data) according to the power network security operation center.

[0100] In some embodiments, the data source can be collected in various ways. For example, by selecting available original historical data sources in the security operation center, which commonly include: network traffic logs, such as traffic data generated by IDS / IPS (Snort, Suricata); host logs, such as Windows Event Log, Linux log, host process logs; user behavior logs, which record behaviors such as user logins, permission changes, and operation commands; threat intelligence data, including IOC (Indicator of Compromise, threat indicators) and attack signature libraries; historical event alarms, such as alarm information from firewalls and WAF devices.

[0101] Since the security operation center has completed the field standardization and unification of the logs, users can directly reuse the processing results in the security operation center without data tagging. Real-time data generated by other security devices or business devices such as firewalls, routers, and switches, such as block logs and allow logs (including IP, port, timestamp, protocol type, etc.), can also be collected. After collecting these data, they are forwarded to the security operation center and stored in a distributed storage system (Splunk). Each log record includes the following fields: {timestamp, src_ip, dest_ip, protocol, action, device_id, rule_id}. Then, data cleaning and preprocessing are performed on the real-time data.

[0102] In some embodiments, data cleaning and preprocessing may include: 1. Redundancy cleaning: Delete duplicate log records (such as duplicate alarms for the same traffic from multiple devices); 2. Outlier handling: Remove abnormal data fields (such as missing IP addresses, invalid timestamps); 3. Log format unification: Standardize the fields of different devices. For example, the firewall rule "Block src_ip: 192.168.1.1" is converted to {"src_ip": "192.168.1.1", "action": "block"}, and the IDS rule ID = 12345: SQL injection is converted to {"rule_id": 12345, "attack_type": "SQL Injection"}.

[0103] In some embodiments, the above step S31 includes steps S311 to S312:

[0104] Step S311: The local original data is obtained by directly reading historical data such as historical logs, event alarms, and threat intelligence stored in the security operation center;

[0105] After the real-time data generated by security devices such as firewalls, IDS / IPS, endpoint detection and response EDR, SCADA, and other business devices enters the security operation center, the security operation center forwards it to the model through a stream processing tool.

[0106] The security operation center provides multi-source data from network traffic, logs, alarms, endpoint behaviors, etc. These data can complete data collection and docking through simple docking, without the need to add additional workload to deploy new collection tools in network nodes. This not only improves the efficiency of the model accessing data, reduces the technical difficulty, and does not require additional data acquisition methods. At the same time, it also greatly reduces the time cost and economic cost in the early stage of the model training phase.

[0107] Step S32: According to the original data of the power network security operation center, convert and unify the formats in a large number of different types of original data sources, and at the same time perform feature extraction and data partitioning.

[0108] After obtaining multi-source data, perform rule extraction and matching on these data, and import built-in rule libraries from security devices. For example: Firewall rule: Block traffic based on IP / port; IDS rule: Detect specific attack patterns based on Snort rules; EDR rule: Detect file tampering based on process behavior. Use these rules to automatically label the log data received by the security operation center to generate the following results: Label 1: Normal (no alarm, or the rule identifies as low-risk traffic); Label 2: Known threat (the rule clearly matches, such as SQL injection, brute force cracking); Label 3: Potential anomaly (the rule is not clear, but there are suspicious behaviors, such as abnormal communication frequency).

[0109] In some embodiments, for example, the firewall records that source IP 192.168.1.2 initiates more than 500 connections to port 22 of 192.168.1.110 within 5 minutes. This is only network data and is unlabeled data. The firewall records that source IP 192.168.1.2 initiates more than 500 connection attempts to port 22 of 192.168.1.110 within 5 minutes, triggering rule Rule-ID: FW-123 (brute force cracking behavior). The IDS identifies that the traffic contains abnormal HTTP header information, triggering rule Rule-ID: IDS-456 (potential vulnerability detection). The security operation center combines the two logs and labels them as "high-risk scanning behavior", and extracts traffic characteristics (such as the number of connections, time interval) and stores them in the database. This is the labeled data.

[0110] Further refinement is carried out in combination with multi-device rules. For example, if the IDS alarm is "potential scanning behavior", but the firewall blocking log records frequent access, it is marked as "high-risk scanning behavior".

[0111] Subsequently, feature extraction and vectorization are performed on these data: First, text features: Convert device logs (such as alarm logs, system event logs) into numerical features, such as using methods like TF-IDF (Term Frequency-Inverse Document Frequency) or Word2Vec. Second, traffic features: Convert various metrics of network traffic data (such as IP, port, protocol, traffic size, packet size, etc.) into numerical features. Third, time features: Extract the patterns of time series data through feature engineering, such as the periodic changes in traffic, the suddenness of alarms, etc. Fourth, for traffic features, extract features including traffic rate, packet size distribution, attack interval, protocol type, communication frequency, etc.; Use the frequent pattern mining algorithm (Apriori) to extract the frequent item sets of historical attack behaviors (specific IP, port, protocol combinations such as src_ip+protocol+action, camouflage means, payloads in network packets, etc.); Analyze the time patterns of attack behaviors (frequent access to power control systems during non-working hours, regular access to system applications during unattended times, etc.). Finally, obtain high-frequency feature combinations for expanding the attack feature library. Fifth, for the obtained features, use feature vectors to represent the extracted features, and adopt dimensionality reduction methods such as PCA (Principal Component Analysis), t-SNE, etc. to reduce the dimension of the feature space, improve the computational efficiency of the model, and retain sufficient information for attack recognition. The features are uniformly stored in the feature library for use by the model. Features can be divided into static features such as attack source IP, malicious file hash, specific protocol anomalies, etc., as short-term and timely iterative features; Dynamic features such as time series behavior, traffic change trend, attack techniques, etc. are used as long-term and continuously updated features.

[0112] In some embodiments, the above step S32 includes the following steps S321 to S325:

[0113] Step S321: Perform feature extraction on the protocol type, packet size distribution, flow direction, time interval, etc. of the original network traffic log data; The following is the protocol type distribution formula in S21: Let the protocol type set be P = P 1 , P 2 ,..., P n , where each P i represents a protocol type.

[0114]

[0115] In the formula, f(Pi ) represents protocol P i The frequency of occurrence, N(P i ) represents the number of data packets containing protocol P i ; N total represents the total number of data packets.

[0116] The packet size refers to the number of bytes of a single network data packet. The distribution of packet sizes in the network can reflect the nature of the traffic. Common methods for extracting packet size features include statistical mean, standard deviation, maximum value, minimum value, etc. of the packet size.

[0117] Basic statistics of the packet size, including the mean packet size, the standard deviation of the packet size, and the maximum and minimum values of the packet size; specifically, as follows:

[0118] Mean packet size: where N is the total number of data packets, and size i is the size (in bytes) of the i-th data packet.

[0119] Standard deviation of the packet size: where μ size is the mean of the packet size.

[0120] Maximum and minimum values of the packet size: max size = max(size i ), min size = min(size i ).

[0121] Flow characteristics refer to the direction in which data packets flow in the network, usually divided into inbound traffic and outbound traffic. Statistics can be made on features such as the number, frequency, or size of data packets in different directions.

[0122] Frequencies of the flow directions, including the inbound traffic frequency and the outbound traffic frequency, specifically as follows:

[0123] Inbound traffic frequency: Outbound traffic frequency:

[0124] Time interval characteristics are mainly used to describe the arrival time interval between data packets and can usually be used to detect attack patterns (such as traffic anomalies in DDoS attacks). Common time interval characteristics include the average time interval, the maximum time interval, and the minimum time interval between data packets, etc.

[0125] Basic statistics of the time interval, including the average time interval, the standard deviation of the time interval, and the maximum and minimum time intervals, specifically as follows:

[0126] Average time interval:

[0127] Wherein, ti is the arrival time of the i-th data packet, and N is the number of data packets.

[0128] Standard deviation of the time interval:

[0129] Maximum time interval and minimum time interval:

[0130] max interval = max(t i+1 - t i ), min interval = min(t i+1 - t i );

[0131] Step S322: Perform feature extraction on the process startup, registry operations, file read / write, API call sequence, etc. of the original host log data;

[0132] Step S323: Perform feature extraction on the user activity time period, operation mode, etc. of the user behavior log data;

[0133] Step S324: Perform feature extraction on threat intelligence by matching features such as source IP, domain name, file hash value, etc., and associate with existing traffic features;

[0134] In the embodiment, let the source IP address in the traffic log be IPsrc, and the attack source IP list be IP threat = IP 1 , IP 2 ,..., IP n . For each traffic packet, check whether its source IP appears in the known malicious IP list in the threat intelligence, and use the following formula for matching:

[0135] Wherein, Match = 1 indicates a match, and Match = 0 indicates no match.

[0136] The association between the attack source domain name and network traffic, and the file hash value association are the same as the above method.

[0137] In order to comprehensively analyze the association between threat intelligence such as source IP, domain name, file hash value, etc. and network traffic data, weighted association can be performed through the following method:

[0138] Assume that the traffic feature is F = {F 1 , F 2 ,..., F m}, where each F iRepresents a specific network traffic characteristic (such as packet size, protocol type, time interval, etc.). Combining the matching results of threat intelligence, define the total association score S total as follows:

[0139]

[0140] In the formula: Match IP is the source IP matching result, Match Domain is the domain name matching result, Match Hash is the file hash value matching result. ω 1 , ω 2 , ω 3 , ω 4 are weights, reflecting the importance of each feature. F i is other features of the traffic.

[0141] According to the comprehensive score S total , the deep learning model can determine whether the current traffic is attack traffic or is associated with known attack activities. If the score exceeds a certain threshold, the traffic is considered malicious and the response mechanism is triggered.

[0142] Step S325: After the feature data extracted through the above steps is obtained in the power system security operation center, the data is partitioned.

[0143] Actually, in the power system network security operation center, most of these data have completed the data field parsing work. The data of similar products of different brands have been unified in fields and formats, and different types of data have also been accelerated through their respective data models, avoiding the duplication of the work of the security operation center and the model data parsing work, and reducing the time cost and economic cost in the early stage of the model training phase.

[0144] In some embodiments, the above step S325 includes the following step S3251: The data partitioning can be classified into unlabeled data, labeled data, and enhanced data. After the data is trained, the judgment results of the real-time data are returned to the security operation center.

[0145] Among them, unlabeled data: Unlabeled data refers to data without any labels or target values. In the field of network security, it usually refers to network traffic data, terminal logs, industrial control communication data, etc. that are not clearly labeled as "normal" or "attack". Unlabeled data usually comes from the original traffic or logs in the daily production environment, and these data have not been manually labeled or annotated. The data does not have any clear output labels and only contains input features.

[0146] Among them, there is labeled data: Labeled data refers to that each data instance has a corresponding label or target value. In the field of network security, labeled data generally refers to network traffic or terminal event data that has been marked as "normal" or "attack" by security experts or related tools, such as DDoS attacks (Distributed Denial of Service attacks), malicious scans, etc. Labeled data is usually provided by the automatic detection of security tools such as IDS / IPS (Intrusion Detection System IDS, Intrusion Prevention System IPS), EDR, or threat intelligence sources. Each data instance has a label (for example, attack type, whether it is malicious traffic, etc.), and the label can be discrete (such as a classification label) or continuous (such as a numerical label in a regression problem).

[0147] Among them, enhanced data: Enhanced data is the result of the model's analysis and judgment of real-time data after learning, that is, labeled data generated by the model's judgment without special formulas. The generation of this data itself comes from the model's real-time monitoring and judgment results after learning the first two types of data, and these result data are re-input as learning data, enabling the model to continuously iterate the feature library and strengthen the detection ability.

[0148] Step S33: Based on network feature data, mine attack behavior patterns and features to expand the threat feature library (i.e., the network attack feature library) and enhance the deep learning model (i.e., the detection model), and construct targeted intrusion detection capabilities by deeply analyzing actual threat samples.

[0149] Exemplarily, based on the behavior analysis of network traffic, use unsupervised learning methods such as K-means clustering, DBSCAN, etc. to analyze the behavior patterns in network traffic, discover abnormal traffic, cluster the network traffic data, identify normal and abnormal traffic patterns, and identify potential attack behaviors through the analysis of cluster centers (for example, a large number of TCP SYN packets may indicate a DDoS attack).

[0150] Exemplarily, based on the analysis of device behavior, analyze the behavior of SCADA devices in the power system, identify devices that do not conform to normal behavior (such as unauthorized device connections, frequent configuration changes, etc.), use anomaly detection methods (such as IsolationForest, One-ClassSVM) to analyze the operation logs of devices, find abnormal operations, compare device behavior with historical behavior patterns, and discover new attack patterns.

[0151] Exemplarily, expand the feature library. Based on the results of real-time behavior analysis, generate new features and expand the existing attack feature library. Extract new abnormal behavior patterns (such as port scanning, abnormal user behavior patterns, etc.) from the behavior analysis and add them to the feature library. Regularly update the feature library to include new attack behaviors, malicious activities, etc. in the model training and detection scope.

[0152] Exemplarily, for the time-series behavior pattern analysis based on LSTM (Long Short-Term Memory), use the LSTM model to perform time-series pattern analysis on device behaviors, identify attack patterns that do not conform to normal behaviors. Input: historical operation behaviors, device access records, traffic data, etc. Output: attack detection (such as lateral penetration, internal network DDoS, etc.). LSTM can capture the time-series nature of device behaviors and has stronger recognition ability for long-span attack behaviors (such as APT attacks, intermittent DDoS attacks).

[0153] Exemplarily, for local anomaly detection based on CNN (Convolutional Neural Network), use CNN to extract features and detect abnormal patterns in traffic. Input: real-time traffic data. Output: classification of traffic to determine whether it belongs to known attack patterns.

[0154] In some embodiments, based on the analysis of behavior patterns, further construct a model attack library. Specifically, it is divided into the following steps:

[0155] Collect attack event data. Collect detailed data of known attack events from the historical data of the security operation center, including DDoS, SQL injection, malicious remote access, etc. Extract relevant alarm data from devices such as IDS / IPS, WAF, and firewalls. Through combined analysis, classify and label these attack data.

[0156] Attack feature extraction and construction. Extract the features of each attack and construct an attack feature library. Network layer features: such as IP, port, protocol, traffic pattern, etc. Behavior layer features: such as login failure, unauthorized access, frequent port scanning, etc. System event features: such as file modification, process creation, memory operation, etc.

[0157] Attack classification and recognition based on deep learning. Use deep learning models to classify attack events. Models: deep learning models such as LSTM, CNN, etc. Input: network traffic, behavior data, alarm information, etc. Output: identify the attack type (such as DDoS, lateral penetration, malicious code execution, etc.).

[0158] Vectorize the key features of attack events and input them into a deep learning model for pattern learning. The model dynamically adjusts its detection ability for new attack behaviors by comparing historical features with new features. After each new attack behavior is detected, its features are added to the feature library and automatically classified into similar attack patterns through unsupervised learning (such as the clustering algorithm K-Means).

[0159] And generate new rules based on the newly discovered attack features. Generate corresponding IDS / IPS rules according to the new attack patterns recognized by the model. For the new attack features recognized by the deep learning model, generate rule-based signatures (such as Snort rules, Suricata rules), and then add the newly generated rules to the rule library of the security operation center to ensure the ability to identify new attacks.

[0160] At the same time, optimize the existing rule library to reduce false positives and false negatives. Use incremental learning algorithms (such as online SVM, incremental decision trees, etc.) to continuously optimize the rule library, adjust the rule parameters through feedback and verification data, automatically generate new detection rules using deep learning models and behavior analysis models, and regularly update the rule library. Analyze attack data based on the deep learning model to generate new attack pattern features. Use rule-based systems (such as Snort, Suricata) to automatically generate corresponding signature rules. An automated tool regularly scans attack events in the security operation center, generates new rules, and automatically updates them to the existing rule library.

[0161] In some embodiments, step S33 includes the following steps S331 to S333:

[0162] S331. Perform feature learning on unlabeled data using an autoencoder, construct a normal behavior baseline, compare the reconstruction error, identify abnormal data, and perform unsupervised learning training;

[0163] Among them, the autoencoder is used for tasks such as data dimensionality reduction, feature learning, and anomaly detection. The autoencoder can have different architectures, and which architecture to choose depends on the corresponding application requirements.

[0164] Standard Autoencoder

[0165] The standard autoencoder consists of an encoder and a decoder, aiming to learn to compress the input data into a low-dimensional hidden layer representation (latent space), and then reconstruct the input data from this compressed representation.

[0166] Architecture: Encoder: Maps the input data (usually high-dimensional data) to a low-dimensional latent space. The encoder usually consists of several layers of fully connected (Dense) networks, gradually reducing the number of neurons. Decoder: Reconstructs the input data from the low-dimensional latent space. The structure of the decoder is similar to that of the encoder, but the number of layers gradually increases, gradually restoring to the dimension of the input data.

[0167] Specific parameters: Number of layers: Common encoders and decoders usually have 2 - 4 layers each. Activation function: The activation function of the encoder usually uses ReLU, and the activation function of the decoder generally uses sigmoid or tanh. Latent layer (hidden layer) size: This is the core of the compressed data, usually much less than the input layer, perhaps 10% to 1% of the input dimension. Loss function: Uses reconstruction error, such as mean squared error (MSE) or cross-entropy loss.

[0168] Stacked Autoencoder

[0169] A Stacked Autoencoder stacks multiple autoencoders and learns multi-level feature representations of the data through layer-by-layer training. The output of each autoencoder becomes the input of the next autoencoder until a deep neural network is constructed.

[0170] Architecture: Encoder stack: Each layer of the encoder gradually compresses the dimension of the data. The output of the first layer of the encoder serves as the input of the second layer of the encoder, and so on. Decoder stack: The decoder also restores the data layer by layer. Each layer of the decoder maps the output of its upper layer to a higher dimension.

[0171] Specific parameters: Number of layers: Usually stacks 3 - 5 layers. Latent layer dimension: The latent dimension of each layer decreases layer by layer. Usually, the first layer is 50% smaller than the second layer, the second layer is 50% smaller than the third layer, and so on. Activation function: ReLU (commonly used in encoders) and sigmoid / tanh (commonly used in decoders). Pretraining: Each autoencoder is usually trained separately in an unsupervised manner. After training, they are stacked into a large autoencoder for joint training.

[0172] Variational Autoencoder (VAE)

[0173] The Variational Autoencoder (VAE) is a probabilistic variant of the autoencoder. In addition to the traditional encoder and decoder architectures, it generates data by assuming that the latent space conforms to a certain probability distribution (usually a Gaussian distribution). The VAE introduces an additional regularization term to ensure that the distribution of the latent space matches the prior distribution, thus allowing the generation of new samples.

[0174] Architecture: Encoder: Similar to a standard autoencoder, the encoder compresses the input data into the latent space. However, the output of the VAE is not a single point but a probability distribution (mean and variance) in the latent space. Decoder: Reconstructs the input data from samples in the latent space.

[0175] Specific parameters:

[0176] Latent space dimension: Usually set to a small value (e.g., 10 - 50), which needs to be adjusted in experiments.

[0177] Activation function: The encoder usually uses ReLU, and the decoder uses sigmoid or tanh.

[0178] Loss function: The loss function of the VAE consists of two parts:

[0179] Reconstruction loss: Measures the difference between the input data and the reconstructed data, commonly using MSE or cross - entropy.

[0180] KL divergence loss: Measures the difference between the latent space distribution and the prior distribution (usually the standard normal distribution).

[0181] The specific formula of the loss function can be expressed as: L = E q(z|x) [logp(x|z)] - D KL [q(z|x)||p(z)]

[0182] where, E q(z|x) [logp(x|z)] is the reconstruction loss, D KL [q(z|x)||p(z)] is the KL divergence, and L is the loss.

[0183] Sparse Autoencoder

[0184] A sparse autoencoder is a variant of the autoencoder. It adds a sparsity constraint to the hidden layer, making the neurons in the hidden layer of the encoder remain "off" most of the time, so that the number of activated neurons is small. This method enables the autoencoder to learn more sparse and meaningful feature representations.

[0185] Architecture: Encoder: Restricts the activation of hidden layer neurons through a sparsity constraint (e.g., L1 regularization). Decoder: A standard decoder used to reconstruct data from the sparse hidden layer.

[0186] Specific parameters:

[0187] Sparsity constraint: Usually implemented through L1 regularization or KL divergence.

[0188] Loss function: It can be the sum of a standard reconstruction loss (such as MSE or cross - entropy loss) and a sparsity loss; where,

[0189] Sparsity loss: By controlling the number of activated neurons, it forces the encoder to learn a sparse representation. The specific formula of the loss function can be expressed as: L = MSE+λ·Sparsity Penalty,

[0190] Among them, the reconstruction error threshold for the auto - encoder is used to determine whether the input data is abnormal data, usually achieved by calculating the error between the input data and the reconstructed data. If the reconstruction error is higher than a predetermined threshold, the data is judged to be abnormal. There are various specific setting methods for the threshold, and it can be dynamically adjusted according to the application scenario and data characteristics.

[0191] In this embodiment, a static threshold setting method and a dynamic threshold adjustment method are shown.

[0192] Static threshold setting method

[0193] Statistical method based on historical data:

[0194] The threshold can be calculated through the reconstruction error distribution of the training set. For example, the mean (Mean) and standard deviation (StandardDeviation) of the reconstruction error of the training data can be used to set the threshold:

[0195] λ = μ + k·σ

[0196] In the formula, λ represents the threshold, μ is the mean of the reconstruction error of the training data, σ is the standard deviation, and k is a constant, usually taking values between 2 and 3. In this way, a threshold based on the training data error can be set.

[0197] Percentile method: Another commonly used method is to set the threshold based on the percentile of the error distribution. For example, the threshold can be set as the 95th percentile of the reconstruction error distribution, so that the reconstruction errors of 95% of the normal samples are lower than this threshold.

[0198] λ = P 95

[0199] In the formula, λ represents the threshold, and P95 is the 95th percentile of the reconstruction error of the training data.

[0200] Dynamic threshold adjustment method

[0201] In some cases, especially for complex and fast - changing systems (such as power grid data), static thresholds may not be able to effectively adapt to the dynamic changes of the data. Therefore, dynamically adjusting the threshold is a more flexible and adaptable strategy. The adjustment of the dynamic threshold can be based on the following methods:

[0202] Sliding window method: By introducing a sliding window to calculate the mean and standard deviation of the real-time reconstruction error, the threshold is updated. For example, assume that within a certain time period (such as the past 30 minutes), calculate the mean and standard deviation within this time period to update the threshold in real time:

[0203] λ t = μ t + k·σ t

[0204] In the formula, λ represents the threshold, μt and σt are the mean and standard deviation of the reconstruction error within the past time window, and k is a constant.

[0205] Adaptive adjustment based on model performance: Use machine learning algorithms (such as gradient descent) to optimize the threshold and dynamically adjust the threshold to minimize the misclassification rate. For example, the reconstruction error can be used as an input feature, and the optimal threshold can be selected through an optimization algorithm to improve the detection accuracy of the model in different scenarios.

[0206] Incremental learning method: Over time, the data distribution of the system may change. The parameters of the autoencoder can be continuously adjusted through the incremental learning method, and the threshold of the reconstruction error can be updated. In this way, the autoencoder can adapt to the new data distribution, thereby improving the detection accuracy.

[0207] In some embodiments, step S331 may include step S3311: After performing unsupervised learning training, obtain the normal behavior feature result as the normal situation baseline to identify other abnormal features.

[0208] Step S332: Through training with a deep learning model on the labeled data, perform attack behavior feature analysis on the labeled data, that is, the security operation center rule alarms and security device alarms, and perform self-supervised learning training.

[0209] In some embodiments, the data of the power grid system usually has temporality and diversity, and static thresholds may not accurately reflect the changes in the operating state of the power grid at different time periods. Therefore, dynamically adjusting the reconstruction error threshold is particularly important. The specific practices can include the following aspects:

[0210] Dynamic threshold based on time series analysis: Some attack behaviors in the power grid (such as DDoS, data tampering, etc.) may present time series characteristics different from normal behaviors. By analyzing the time series changes of the power grid data (such as load, power generation, communication status, etc.), the threshold can be dynamically adjusted according to the change trend of the time series data.

[0211] Threshold adjustment based on environmental changes: For example, the power grid may experience changes in data patterns due to factors such as seasonal variations, equipment maintenance, or emergencies. In such cases, a sliding window method using historical data can be employed to dynamically adjust the threshold to ensure its suitability for the current power grid environment.

[0212] Suppose we use the sliding window method and the standard deviation threshold setting method to adjust the threshold. The specific steps and formulas are as follows:

[0213] First, calculate the mean and standard deviation of the reconstruction error within the sliding window:

[0214]

[0215] In the formula, ei is the reconstruction error of the i-th sample within the time window, and n is the number of samples within the window.

[0216] Secondly, calculate the dynamic threshold:

[0217] λ t =μ t +k·σ t

[0218] In the formula, k is a constant, usually set to 2 or 3.

[0219] Judge whether the data is abnormal: If the reconstruction error e at a certain moment is greater than the threshold, it is considered that the power grid data at that moment is abnormal:

[0220] Abnormality judgment: e > λt.

[0221] In some embodiments, the foregoing step S332 includes step S3321: After training through self-supervised learning, different attack behavior features are obtained and added to the attack feature library to further optimize the model. Among them, the attack behavior features (AttackBehaviorFeatures) refer to the key features that can identify and describe the attacker's behavior in attack activities occurring in a network or system. This can be reflected in the following aspects:

[0222] Network traffic features, which may include the following:

[0223] Traffic pattern: The differences in time, size, and frequency between attack traffic and normal traffic. For example, in a DDoS attack, the traffic surges, and in a port scan, the traffic is intermittent.

[0224] Protocol type: An attack may use a specific protocol (such as HTTP, FTP, DNS, ICMP, etc.) as a carrier or adopt an abnormal protocol combination. For example, a buffer overflow attack may send malicious payloads to a web server through the HTTP protocol.

[0225] Source / Destination IP Address: Attack traffic may originate from specific IP addresses (such as botnets) or a large number of unrelated source IP addresses (such as DDoS attacks). Unusual IP address behavior, such as a large number of requests sent from a single source IP to multiple destination IPs, may also be a sign of an attack.

[0226] Port Scanning Characteristics: Attackers often scan a large number of ports to find vulnerabilities, and this behavior will manifest as a large number of accesses to multiple ports within a short period of time.

[0227] Packet Size and Traffic Rate: Attackers may adopt different strategies to create atypical packet sizes or irregular data traffic. Certain attacks (such as DoS, DDoS, SMB brute force, etc.) will exhibit unconventional traffic patterns.

[0228] Latency and Temporal Distribution: The temporal distribution of attack traffic may be significantly different from normal traffic. DDoS attacks usually manifest as a large amount of traffic within a short period of time; while some slow data leakage attacks (such as slowloris attacks) may present as small-scale traffic over a long period of time.

[0229] Terminal Behavior Characteristics, which may include the following:

[0230] Process Behavior: Attackers may execute malicious processes through malware or scripts, and the behavior of these processes is significantly different from normal processes. For example, malicious processes may attempt to modify system settings, access sensitive files, or run with abnormal privileges.

[0231] File Operations: Malicious behavior usually manifests as unusual file access patterns, such as accessing, modifying, or deleting critical system files, the registry, etc.

[0232] Abnormal Login Behavior: Attackers often steal login credentials through brute force, phishing, or social engineering means. Login behavior may manifest as logins at abnormal times, multiple attempts to log in from different geographical locations, etc.

[0233] Privilege Escalation Behavior: Attackers may attempt to elevate their privileges in the network, manifested as behaviors such as creating new users, changing permissions, accessing high-privilege resources, etc.

[0234] Protocol and Application Layer Characteristics, which may include the following:

[0235] Protocol Abuse and Vulnerability Exploitation: Attackers may abuse certain protocols (such as SQL injection, LDAP injection, etc.) to execute attacks through malicious requests in a specific format. Analyzing the parameters, return values, status codes, etc. of malicious requests can identify these attack behaviors.

[0236] Abnormal API Calls: Certain attack behaviors (such as remote code execution, privilege escalation, etc.) can generate abnormal API call patterns or abnormal requests for specific APIs.

[0237] Temporal Characteristics, which may include the following:

[0238] Attack Initiation Time: Many attacks have specific temporal characteristics. For example, DDoS attacks usually send a large amount of traffic in a short period of time, while some APT attacks (Advanced Persistent Threats) may be initiated gradually over a long period of time. Analyzing the time, frequency, and time period of attack occurrences can identify attack patterns.

[0239] Attack Duration: Attacks usually have a certain duration, especially persistent attacks (such as APT attacks). The duration and interval of attacks can provide clues about the type of attack.

[0240] Abnormal Behaviors and Deviations from Normal Patterns, which may include the following:

[0241] Behavioral Inconsistency: Attackers usually do not follow normal operation procedures. For example, normal user access should be relatively regular, while the behavior of attackers may be sudden, abnormally frequent, and without obvious regularity.

[0242] Abnormal Changes in Behavioral Traffic: For example, the traffic in the network changes from normal network activities to abnormal access within a short period of time, which may indicate that a vulnerability has been attacked.

[0243] Purposes and Intentions of Attacks, which may include the following:

[0244] Data Leakage: By analyzing network traffic, system logs, etc., the behavior of data leakage can be identified. For example, a large number of files are copied or transferred to external servers, or unconventional data packets flow to unknown destinations.

[0245] Resource Exhaustion (such as DoS, DDoS attacks): Attack behaviors can exhaust the resources of the target system by sending a large number of requests, making the target unable to respond to services normally. The traffic characteristics of such attacks often show large-scale, continuous requests targeting the same target.

[0246] System Invasion: By analyzing malicious characteristics in network traffic, such as port scanning, vulnerability exploitation requests, etc., it can be identified that attackers are trying to bypass the firewall, invade the system, or elevate system privileges.

[0247] Attack Tools and Techniques, which may include the following:

[0248] Malware characteristics: including Trojans, ransomware, viruses, etc., analyze the propagation paths, behavior patterns, communication characteristics, etc. of malware.

[0249] Attacks using known vulnerabilities: Attackers initiate attacks by exploiting known vulnerabilities in systems, applications, or protocols. Common attack methods include SQL injection, XSS attacks, buffer overflows, etc.

[0250] Step S333: Add the potentially abnormal traffic initially identified through the research and judgment results of unsupervised learning of the model to the training dataset to further optimize the model and perform semi-supervised learning training. Step S333 may include steps S3331 to S3332:

[0251] Step S3331: After semi-supervised learning training, supplement historical data and real-time data to update the feature library.

[0252] Step S3332: By updating the feature library, eliminate the old attack features and perform real-time update and rule enhancement on the feature library.

[0253] In some embodiments, the real-time update and rule enhancement in step S3332 are mainly carried out in the following ways:

[0254] The following introduces the feature library update algorithm:

[0255] First, feature update based on reconstruction error:

[0256] In a deep learning model (such as an autoencoder), new attack behaviors are identified by analyzing the reconstruction error of the training data. If the system detects that the reconstruction error of a new attack behavior is greater than the current threshold, it may indicate that this attack type is not yet included in the existing feature library.

[0257] Update mechanism: When a new attack pattern is discovered, relevant features (such as the packet size, time distribution, IP address, port, etc. of the attack traffic) are added to the feature library. By comparing with the existing features, if it is found that the similarity between the new feature and the existing features is low, it is regarded as a new attack feature and added.

[0258] Formula: Assume that the reconstruction error et calculated by the model exceeds the current threshold, indicating the occurrence of a new attack behavior:

[0259] e t >λ t , then update the feature library. Subsequently, the new attack feature ft will be added to the feature library.

[0260] Feature library t = Feature library t-1 ∪f t

[0261] Second, incremental learning algorithm:

[0262] To meet the need for feature library updates, incremental learning (Incremental Learning) can be adopted, that is, without completely retraining the model, the existing feature library is updated using new data (such as new attack samples). Common incremental learning methods include online learning algorithms and adaptive feature selection algorithms.

[0263] In this embodiment, an online learning algorithm is shown.

[0264] Through an online update algorithm (such as Stochastic Gradient Descent), the model can be incrementally updated when new data arrives.

[0265] In the embodiment, an adaptive algorithm based on gradient descent is adopted. When new data samples Xt and labels yt are input:

[0266]

[0267] where L is the loss function and η is the learning rate, is the parameter gradient.

[0268] Through incremental learning, the most discriminative features in the feature library are continuously updated, and those redundant or useless features are removed. For example, metrics such as information gain, mutual information, and variance can be used to evaluate the effectiveness of features, thereby eliminating features that are no longer useful.

[0269] Third, adaptive feature update:

[0270] As the network environment changes, some attack features may gradually become ineffective or no longer applicable. Therefore, an adaptive mechanism is used to regularly evaluate the effectiveness of existing features and eliminate outdated features according to the actual effect.

[0271] Update based on model performance: Use machine learning models (such as support vector machines, decision trees, etc.) to evaluate the contribution degree of each feature. When the contribution degree of some features to the model is low, they can be eliminated.

[0272] Update based on feature weight adjustment: Each feature in the feature library can have a weight (such as dynamically adjusted according to the classification effect of each feature during the training process). When the weight of a certain feature gradually approaches zero, it can be considered for removal.

[0273] Weight adjustment formula:

[0274] ω i = αω i +(1 - α)·k where ωi where \(w_i\) is the weight of feature \(i\), \(\alpha\) is the smoothing factor, and \(k\) is the feature importance, which is based on the feedback of model learning.

[0275] The following describes the update based on rule synthesis:

[0276] After the features of a new attack enter the feature library, the rule library can be updated by synthesizing new rules. The ways of synthesizing rules can be as follows:

[0277] Rule merging: If it is found that some attack features have a high matching degree with existing rules, the matching ability of the existing rules can be strengthened through rule merging. For example, combine the features of the new attack with the conditions of the existing rules to generate a new composite rule.

[0278] Rule extension: Based on new features and attack patterns, the existing rule library can be extended. For example, in DDoS attack detection, if the existing rules only detect a single attack source IP, the rule can be extended to detect attack patterns of multiple source IPs.

[0279] The following describes rule reconstruction and priority update:

[0280] The priority of the rule library also needs to be updated according to the severity and frequency of attacks. Attacks that occur frequently and have a great impact can be set as high-priority rules.

[0281] Priority update: When it is detected that the occurrence frequency of a certain type of attack increases significantly, the detection intensity can be increased by adjusting the priority of the rule. For example, for DDoS attacks, when it is found that the detection frequency within a certain period of time reaches a certain threshold, increase its priority.

[0282] Priority update formula:

[0283] Rule i → Priority(Rule i ) + 1

[0284] The update of the feature library and the rule library is based on the following trigger conditions:

[0285] 1. Appearance of new attack samples: When the system detects new attack samples that do not match the existing samples, it triggers the update of the feature library and the rule library. 2. Reconstruction error exceeds the threshold: When the reconstruction error increases significantly, indicating that new attack patterns may appear, it triggers the update of the feature library and the rule library. 3. Detection performance of rules decreases: If the detection rate of some attacks decreases or the false alarm rate increases, it can trigger the update of the rule library. 4. Time period or maintenance period: Regularly check and update the feature library and the rule library. For example, conduct a comprehensive rule and feature update monthly or quarterly.

[0286] Similarly, as described in step S3251 above, the data for model learning comes from three types of data, and different methods are required for different data. Unsupervised learning training is mainly used to establish a normal behavior baseline, and to find abnormal spikes and potential abnormal situations by comparing real-time data with the baseline. Self-supervised learning is used to obtain various characteristics of the attacker's attack behavior with the help of historical research and judgment data and the detection results of security equipment, thereby establishing an attack detection feature library. Semi-supervised learning is that after the model is put into use after learning, the results of monitoring and detection of real-time data are re-input as learning data to maintain the advanced nature of the model's detection capabilities.

[0287] Step S34: Perform attack detection on real-time data through the network attack feature library and detection model, classify them into known attack types and unknown attack patterns, and generate a defense decision plan.

[0288] In some embodiments, step S34 includes the following steps S341 to S344:

[0289] Step S341: The model discovers attack behaviors caused by attackers by analyzing network traffic data, terminal process data, industrial control communication data, etc., including but not limited to: abnormal request bodies, malformed data packets, sensitive process calls, abnormal industrial control instructions and other known attack methods and malicious behaviors.

[0290] Step S342: With the help of the established feature library, the model monitors the changes and trends of various indicators in the environment in real time, discovers abnormal data spikes, and detects deeply hidden persistent unknown attack behaviors.

[0291] Among them, abnormal data spikes can be defined in the following ways:

[0292] Method 1: Based on the definition of statistical indicators. Statistical methods mainly detect data spikes by calculating the distribution characteristics of historical data (such as mean, standard deviation, etc.). Abnormal data spikes refer to the significant deviation of current data from the typical distribution pattern of historical data.

[0293] (1) Anomaly detection based on mean and standard deviation

[0294] The most common way is to use mean and standard deviation to define the distribution range of normal data. When the deviation of a data point exceeds the set threshold, the data point is considered abnormal.

[0295] Assume that a set of historical data {x 1 , x 2 , ..., x n}, whose means and standard deviations are:

[0296] and Then, an abnormal data spike is defined according to a predetermined deviation threshold (k). If a data point x t exceeds the range of k standard deviations from the mean, then this data point is considered an abnormal spike.

[0297] Abnormality determination: |x t - μ| > k·σ, where k is a constant, usually taken as 2 or 3, representing the multiple of the standard deviation by which the data point deviates from the mean. If x t deviates from the mean by more than k standard deviations, it can be considered an abnormal spike.

[0298] (2) Anomaly detection based on deviation

[0299] It is also possible to determine whether there are spikes by calculating the skewness of the data. Skewness measures the symmetry of the data distribution. A larger skewness value usually means there are spikes in the data. If the skewness value exceeds the set threshold range, it can also be considered that the data has become abnormal.

[0300]

[0301] Method 2: Definition based on deep learning models. For more complex scenarios, especially high-dimensional data (such as network traffic, industrial control communication, etc.), deep learning models can usually better capture the complex patterns of the data, and abnormal data spikes can be defined by the prediction errors of the deep learning models.

[0302] (1) Reconstruction error based on autoencoders

[0303] When using an autoencoder for unsupervised learning, the model will learn the low-dimensional representation of the data and reconstruct the original data through this representation. If the reconstruction error of the model exceeds a certain threshold, it is considered that the data is abnormal.

[0304] Assume x t is the input data at the current moment. After being encoded and decoded by the autoencoder, the reconstructed value is Then the reconstruction error (i.e., the difference between the actual value and the reconstructed value) can be expressed as:

[0305]

[0306] Based on the statistical distribution of the error e t and the historical reconstruction errors to determine whether it is an abnormal data spike. If the current reconstruction error e t exceeds a certain percentile or standard deviation threshold of the historical reconstruction errors, it is considered abnormal.

[0307] e t > μ e+k·σ e , where μ e and σ e are the mean and standard deviation of the historical reconstruction error respectively, and k is the threshold constant.

[0308] (2) Error based on the prediction model

[0309] When using deep learning models (such as LSTM, GRU, Transformer, etc.) for time series prediction, the prediction error of the model can be used to judge data spikes.

[0310] Suppose we use an LSTM-based model to predict network traffic. The true value at the current moment t is y t , and the predicted value is Then the prediction error e t is: If this error exceeds a threshold (for example, the prediction error exceeds 3 times the standard deviation of the historical error), it is determined as an abnormal spike.

[0311] e t > μ e +k·σ e ,

[0312] where μ e and σ e are the historical mean and standard deviation of the prediction error, and k is a constant, usually taking a value of 2 or 3.

[0313] (3) Spike detection based on prediction

[0314] For time series data, deep learning models (such as LSTM, GRU) can predict future data points through historical data. If the deviation between the actual data and the predicted value at a certain moment exceeds a certain threshold, then this data point can be considered an abnormal spike.

[0315]

[0316] where δ is the set threshold. This threshold can be dynamically set through historical errors or a quantile-based method.

[0317] By extracting features from data and learning patterns of normal and abnormal behaviors, deep learning models can detect common attack types, including DDoS attacks in which a large amount of malicious traffic hits the target server, making it unable to respond normally; abnormal port scanning attacks in which attackers scan devices in the network to find open ports or vulnerabilities; attackers exploit application layer vulnerabilities by injecting specially crafted data packets (such as vulnerability exploits, SQL injections, cross-site scripting attacks, etc.); attacks that exploit vulnerabilities in certain protocols, such as TCPSYN flood attacks, IP spoofing and other abnormal protocol attacks; malicious operations performed by malware and viruses through system processes, file operations, network connections and other behaviors; attackers gain higher permissions by moving laterally into other systems or using privilege escalation attacks; use of malicious scripts (such as PowerShell scripts, batch scripts, etc.) to infiltrate the system, collect information or perform malicious operations; malicious instructions injected by attackers with the intention of disrupting industrial processes or manipulating equipment; data tampered with during the transmission process that causes the operating status of industrial control equipment to be changed or the control process to be disturbed; and social engineering attacks such as phishing.

[0318] In some embodiments, for detected attacks, the model can give recommendations for defense strategies based on the detected attack behavior characteristics, and specifically repair and mitigate the risks faced by the current power system. Among them, DDoS attacks (distributed denial of service attacks) use a large amount of malicious traffic to make the target system unable to respond to normal requests. The deep learning model can detect and respond to DDoS attacks in advance by identifying traffic surges, abnormal request patterns, etc. The model automatically triggers the traffic diversion mechanism based on the identified DDoS attack characteristics. According to the results of traffic pattern recognition, the rate of traffic inlet is dynamically adjusted when an attack occurs, and the request frequency of each source IP is limited to prevent service overload.

[0319] In some embodiments, for abnormal port scans, the deep learning model is combined with the intrusion detection system (IDS) and the intrusion prevention system (IPS) to detect port scanning behavior by analyzing traffic in real time. For abnormal port scanning activities, the IPS can automatically trigger defense measures to block access from suspicious IPs. Firewall rules are automatically updated based on the port access frequency analyzed by the deep learning model to block unauthorized port scans. When an abnormal port scan is detected, an alert is immediately sent to the security team to respond quickly and take defensive measures.

[0320] In some embodiments, for malicious packet injection, the deep learning model performs in-depth analysis at the packet level, filters and inspects the content in the network traffic, and blocks packets containing malicious code or illegal instructions. For malicious packet injection attacks discovered and released by security devices such as IPS and WAF, the model can provide the identified features to the security device, update the defense capabilities of the security device, and radiate the model capabilities to other existing security devices.

[0321] In some embodiments, for malicious processes and terminal attacks, the deep learning model analyzes terminal processes and behaviors to identify process patterns inconsistent with normal behaviors and discovers suspicious processes. After detecting a malicious process, it can automatically block the execution of the process or isolate the malicious process. Restrict the system permissions of the malicious process to prevent it from lateral movement or privilege escalation.

[0322] In some embodiments, for privilege escalation and lateral movement attack models, monitor system calls and process behaviors to promptly detect abnormal privilege escalation operations or lateral movement behaviors. For example, if it is found that a certain process accesses multiple systems within a short period of time, it may be a sign of lateral movement. Monitor critical operations (such as user privilege changes, reading and modifying important files), and trigger an alarm in a timely manner.

[0323] In some embodiments, for industrial control system attacks, the model can analyze industrial control communication protocols and data streams to discover potential attack activities. After the model discovers abnormal communication traffic, it promptly notifies the industrial firewall and blocks the abnormal communication. Analyze the data packets in industrial control protocols such as Modbus and DNP3 to detect whether there are malicious instructions or data tampering. If abnormalities are found, an alarm can be automatically triggered and the abnormal communication can be interrupted. When detecting abnormal instructions or inconsistent data, immediately initiate an emergency response process, such as stopping the device operation or switching to the safe mode.

[0324] In some embodiments, for phishing attacks and social engineering attacks, the model can detect potential phishing behaviors by identifying abnormal communication patterns, email contents, or network traffic. Detect abnormal links, malicious attachments, or forged sender information in emails to prevent the incoming of phishing emails.

[0325] In some embodiments, for different security policies generated for different security events, link with the security operation center and relevant security devices, and provide the rule parameters to the security devices for updating the security device policies.

[0326] Step S343: Return all detection results to the security operation center as the data source for the next step of learning.

[0327] Step S344: Send the judgment results generated by the model to the security operation center to generate a defense decision plan.

[0328] Traditional protection tools (such as firewalls and IPS) can only detect known attack patterns and are difficult to identify sophisticated hidden threats such as zero-day attacks and APT attacks. Due to the lack of unified event management and cross-device correlation analysis, relying on static rule matching of independent devices, the false positive rate is relatively high. A single device may misjudge normal traffic and legitimate behaviors, resulting in a large number of false alarms. For example, some legitimate network activities (such as large-scale file transfers) may be mistaken for DDoS attacks or malicious activities.

[0329] Through centralized management and multi-source data analysis, a security operations center can identify more attack behaviors and security events. Compared with the situation without a security operations center, a security operations center with a non-deep learning model reduces false alarms through a rule library and manual analysis, but it is still limited by static rules and expert experience and is difficult to handle new and complex attacks.

[0330] By learning a large amount of data, deep learning models can discover abnormal behaviors that cannot be detected by traditional rules, especially having advantages in complex attack patterns such as zero-day attacks and lateral movement within the intranet. Models (such as deep learning-based autoencoders, LSTM, etc.) can effectively filter normal traffic and legitimate behaviors through three supervised learning modes and dynamic adaptation capabilities. Through deep learning of historical data and real-time data, they can distinguish normal behaviors from attack patterns, thereby reducing the false positive rate. Especially in the identification of long-tail data and the capture of trend changes, they can accurately distinguish abnormal and normal behaviors.

[0331] The beneficial effects of the present invention are as follows: by directly importing the historical log data or real-time data stored in the security operations center into the model for integration, offline modeling and behavior analysis are completed. When these data enter the model, the model conducts research and judgment on them, sends instructions according to the research and judgment results, and identifies potential threat events in the power network, which helps to early warn of network security threats. At the same time, the research and judgment results after data analysis will be returned to the model again to continuously update the feature library to achieve the effect of automatic learning. According to the analysis of the behavior characteristics in the feature library, potential threat events in the power network are judged for threat events and specific defense strategies and measures are generated. Through repeated training and automatic learning of the model, the present invention not only improves the comprehensiveness and adaptability of network security protection, but also reduces the technical threshold for users.

[0332] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this document, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-described embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be executed alternately or in turn with at least a part of other steps or steps or stages in other steps.

[0333] Based on the same inventive concept, an embodiment of the present application further provides a power system network security threat monitoring and early warning device for implementing the power system network security threat monitoring and early warning method described above. The solution provided by this device to solve the problem is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the power system network security threat monitoring and early warning device provided below can refer to the limitations on the power system network security threat monitoring and early warning method in the above text, and will not be repeated here.

[0334] In an exemplary embodiment, as Figure 11 shown, the present application further provides a power system network security threat monitoring and early warning device 1100, including:

[0335] An acquisition module 1101, configured to acquire stored historical data and real-time data generated by network security devices in the power system and forwarded by the network security operation center based on the network security operation center of the power system;

[0336] A first training module 1102, configured to extract features from the historical data to obtain first network feature data of the power system; input the first network feature data into a preset initial detection model for unsupervised learning training to determine abnormal data in the first network feature data as second network feature data; and label the second network feature data to obtain third network feature data;

[0337] A second training module 1103, configured to label the first network feature data according to a preset first security rule of the network security device and a preset second security rule of the network security operation center to obtain fourth network feature data of the power system; input the fourth network feature data into a preset initial detection model for self-supervised learning training to obtain a first network attack feature for the power system; and construct a network attack feature library based on the first network attack feature;

[0338] The third training module 1104 is used to input the first network feature data and the third network feature data into a preset initial detection model for semi-supervised learning training to obtain a trained detection model; and based on the semi-supervised learning training, obtain the second network attack feature for the power system; and update the network attack feature library based on the second network attack feature;

[0339] The detection module 1105 is used to perform network attack detection on real-time data based on the detection model and the network attack feature library to obtain a network security threat monitoring result for the power system and transmit it to the network security operation center.

[0340] In one embodiment, the second training module 1103 is further used to label the first network feature data according to a preset first security rule of the network security device and a preset second security rule of the network security operation center to obtain the fourth network feature data of the power system, including: determining a target security rule matching the first network feature data from the preset first security rule of the network security device and the preset second security rule of the network security operation center; labeling the first network feature data according to the target security rule to obtain the fourth network feature data of the power system; the fourth network feature data of the power system includes the fourth network feature data labeled as normal, the fourth network feature data labeled as known threats, and the fourth network feature data labeled as potentially abnormal.

[0341] In one embodiment, the second training module 1103 is further used to determine a target security rule matching the first network feature data from the preset first security rule of the network security device and the preset second security rule of the network security operation center, including: constructing a security rule library according to the preset first security rule of the network security device and the preset second security rule of the network security operation center; determining the target security rule from the security rule library;

[0342] The second training module 1103 is further used to update the rules of the security rule library according to each network attack feature in the network attack feature library; the rule update includes at least one of the following: determining the matching degree between each network attack feature and the security rules in the security rule library, combining the network attack features with a matching degree reaching a preset matching degree and the security rules corresponding to the network attack features with a matching degree reaching a preset matching degree to obtain new security rules; in the case of a new network attack feature, expanding the security rule library based on the new network attack feature.

[0343] In one embodiment, the third training module 1104 is further configured to update the network attack feature library when at least any one of the following conditions is met: there is a new network attack sample; the error between the model input data and the reconstructed data exceeds a threshold; the detection rate of network attacks decreases or the false alarm rate increases; the time since the last update of the network attack feature library reaches a preset time.

[0344] In one embodiment, the first training module 1102 is further configured to perform feature extraction on historical data to obtain first network feature data of the power system, including: preprocessing the historical data, where the preprocessing includes at least one of the following: cleaning redundancy, removing outliers, and unifying formats; performing feature extraction on the preprocessed historical data to obtain first network feature data of the power system.

[0345] In one embodiment, the detection module 1105 is further configured to, when the network security threat monitoring result indicates the existence of a network attack, determine a defense plan corresponding to the network security threat monitoring result and send the defense plan to the network security operation center; when the network security threat monitoring result indicates the existence of a network attack and the existing network attack belongs to a preset network attack type, alarm the network security operation center; and trigger a preset measure corresponding to the network security threat monitoring result based on the network security operation center to perform emergency defense for the network security of the power system.

[0346] Each module in the above power system network security threat monitoring and warning device can be implemented in whole or in part by software, hardware, and their combination. The above modules can be embedded in the processor of the power device in hardware form or be independent of it, or can be stored in the memory of the power device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0347] In an exemplary embodiment, a power device is provided. The power device can be a server, and its internal structure diagram can be as Figure 12As shown in the figure. The power device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O), and a communication interface. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the power device is used to provide computing and control capabilities. The memory of the power device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the power device is used to store data required for power system network security detection, such as historical data, network attack feature libraries, etc. The input / output interface of the power device is used to exchange information between the processor and external devices. The communication interface of the power device is used to communicate with external terminals through a network connection. When the computer program is executed by the processor, it implements a method for monitoring and warning of power system network security threats.

[0348] Those skilled in the art can understand that Figure 12 the structure shown in the figure is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the power device to which the solution of this application is applied. The specific power device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0349] In an exemplary embodiment, a computer device is provided, including a memory and a processor. A computer program is stored in the memory, and when the processor executes the computer program, the steps in the above method embodiments are implemented.

[0350] In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0351] In an embodiment, a computer program product is provided, including a computer program. When the computer program is executed by the processor, the steps in the above method embodiments are implemented.

[0352] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in this application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in this application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic devices, data processing logics based on quantum computing, artificial intelligence (AI) processors, etc., without limitation.

[0353] The technical features of the above embodiments can be combined arbitrarily. For the sake of concise description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered to be within the scope recorded in this application.

[0354] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation to the patent scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A method for monitoring and early warning of network security threats in a power system, characterized in that: include: Based on the network security operation center of the power system, the stored historical data and the real-time data generated by the network security equipment in the power system and forwarded by the network security operation center are obtained; Extracting features from the historical data to obtain first network feature data of the power system; Inputting the first network feature data into a preset initial detection model to perform unsupervised learning training, determining abnormal data in the first network feature data as second network feature data; and labeling the second network feature data to obtain third network feature data; According to a preset first security rule of the network security device and a preset second security rule of the network security operation center, the first network characteristic data is marked to obtain fourth network characteristic data of the power system; Inputting the fourth network feature data into the preset initial detection model to perform self-supervised learning training to obtain a first network attack feature for the power system; Based on the first network attack feature, construct a network attack feature library; Inputting the first network feature data and the third network feature data into the preset initial detection model to perform semi-supervised learning training to obtain a trained detection model; and obtaining a second network attack feature for the power system based on the semi-supervised learning training; Based on the second network attack feature, updating the network attack feature library; Based on the detection model and the network attack feature library, network attack detection is performed on the real-time data to obtain a network security threat monitoring result for the power system.

2. The method according to claim 1, characterized in that The step of labeling the first network characteristic data according to the preset first security rule of the network security device and the preset second security rule of the network security operation center to obtain the fourth network characteristic data of the power system includes: Determining a target security rule matching the first network feature data from a preset first security rule of the network security device and a preset second security rule of the network security operation center; According to the target security rules, the first network characteristic data is labeled to obtain the fourth network characteristic data of the power system; the fourth network characteristic data of the power system includes fourth network characteristic data labeled as normal, fourth network characteristic data labeled as known threats, and fourth network characteristic data labeled as potential abnormalities.

3. The method according to claim 2, characterized in that The step of determining a target security rule matching the first network feature data from the preset first security rule of the network security device and the preset second security rule of the network security operation center includes: Building a security rule library according to the preset first security rule of the network security device and the preset second security rule of the network security operation center; and determining the target security rule from the security rule library; The method further includes: updating the security rule library according to each of the network attack features in the network attack feature library; the rule updating includes at least one of the following: Determine the degree of match between each of the network attack features and the security rules in the security rule library, combine the network attack features whose matching degree reaches a preset matching degree and the security rules corresponding to the network attack features whose matching degree reaches a preset matching degree, and obtain new security rules; When new network attack features appear, the security rule base is expanded based on the new network attack features.

4. The method according to claim 1, characterized in that: The method further comprises: When at least one of the following conditions is met, the network attack signature database is updated: There are new cyber attack samples; The detection rate of cyber attacks decreases or the false positive rate increases; The time since the last update of the network attack signature database reaches a preset time.

5. The method according to any one of claims 1 to 4, characterized in that: The extracting features from the historical data to obtain first network feature data of the power system includes: Preprocessing the historical data, wherein the preprocessing includes at least one of the following: cleaning redundancy, removing outliers, and unifying formats; Feature extraction is performed on the historical data after the preprocessing to obtain first network feature data of the power system.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In the case where the network security threat monitoring result indicates the existence of a network attack, determining a defense plan corresponding to the network security threat monitoring result, and sending the defense plan to the network security operation center; When the network security threat monitoring result indicates the existence of a network attack and the existing network attack belongs to a preset network attack type, an alarm is sent to the network security operation center; and based on the network security operation center, preset measures corresponding to the network security threat monitoring result are triggered to carry out emergency defense for the network security of the power system based on the preset measures.

7. A power system network security threat monitoring and early warning device, characterized in that: The device comprises: An acquisition module, used to acquire stored historical data based on a network security operation center of the power system, and real-time data generated by network security devices in the power system and forwarded by the network security operation center; A first training module is used to extract features from the historical data to obtain first network feature data of the power system; input the first network feature data into a preset initial detection model to perform unsupervised learning training, determine abnormal data in the first network feature data as second network feature data; and annotate the second network feature data to obtain third network feature data; A second training module is used to label the first network feature data according to the preset first security rule of the network security device and the preset second security rule of the network security operation center to obtain fourth network feature data of the power system; input the fourth network feature data into the preset initial detection model to perform self-supervised learning training to obtain a first network attack feature for the power system; and construct a network attack feature library based on the first network attack feature; A third training module is used to input the first network feature data and the third network feature data into the preset initial detection model to perform semi-supervised learning training to obtain a trained detection model; and based on the semi-supervised learning training, obtain a second network attack feature for the power system; based on the second network attack feature, update the network attack feature library; The detection module is used to perform network attack detection on the real-time data based on the detection model and the network attack feature library, obtain network security threat monitoring results for the power system, and transmit them to the network security operation center.

8. An electric power device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images