Power transaction service security risk prediction method and device based on time sequence detection

Abstract

The invention provides a power transaction service security risk prediction method and device based on time sequence detection. The method comprises the following steps: preliminarily dividing linear time sequence data components from time sequence data; evaluating the linear fitting significance of the divided linear time sequence data components by using an autoregression integral moving average model, and further generating a linear service security risk prediction result; performing residual processing on the to-be-observed time series data and time series data of which the linear fitting significance exceeds a preset threshold in the linear time series data component to obtain a nonlinear time series data component; extracting features from the non-linear time sequence data components by using a multi-layer stacked long-short-term memory network, and performing non-linear prediction to generate a non-linear service security risk prediction result; and integrating the linear service security risk prediction result and the nonlinear service security risk prediction result, and obtaining a final service security risk prediction result through an activation function.

Description

Technical Field

[0001] The present invention relates to the technical field of network security service security risk prediction, and in particular, to a method and device for predicting the security risk of power trading services based on time series detection. Background Art

[0002] In the Internet era, the power industry is in a period of rapid development. Emerging power services such as intelligent distributed distribution automation, user-side demand response, and millisecond-level precise load control are booming, and various grid devices, power terminals, and electricity customers are showing explosive growth. The power trading system is a core component in the modern power market, which is responsible for managing the trading process between power supply and demand. With the growth of global energy demand and the advancement of energy system reform, the power market is gradually developing towards liberalization and competition. This transformation has brought a more complex and dynamic market environment, as well as new security risk challenges.

[0003] There are a large amount of trading data, market data, and monitoring data in the power trading system. The data involves multiple participants, multiple markets, and complex trading structures. These complex structures bring uncertainties and complexities to the business security risks of transactions in terms of business, and also greatly increase the difficulty of predicting business security risks. In order to reduce the risks that may occur in the network system, many researchers have adopted various network security technologies in the past few decades to predict the business security risks of time series data.

[0004] Problems existing in the prior art include: (1) Due to the complexity of users and network environment in the power trading system network itself, it is difficult to conduct unified research on users and network environment; (2) Currently, various business security risk prediction models do not extract features of different characteristics in multivariate time series sufficiently and lack long-term dependence; (3) The limitations of a single model have a greater impact on the prediction accuracy.

[0005] Therefore, how to design a more effective and accurate method for predicting the security risk of power trading services is a technical problem to be solved urgently. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a method and device for predicting the security risk of power trading services based on time series detection to eliminate or improve one or more defects existing in the prior art.

[0007] One aspect of the present invention provides a method for predicting security risks in power trading services based on time series detection. The method includes the following steps: performing data preprocessing on the time series data to be observed in the power trading system, and preliminarily dividing out the linear time series data components from the time series data; using an autoregressive integrated moving average model to evaluate the linear fitting significance of the divided linear time series data components, and generating a linear business security risk prediction result based on the time series data with a linear fitting significance exceeding a preset threshold in the linear time series data components; performing residual processing on the time series data to be observed and the time series data with a linear fitting significance exceeding a preset threshold in the linear time series data components to obtain non-linear time series data components; using a multi-layer stacked long short-term memory network to extract features from the non-linear time series data components and generating a non-linear business security risk prediction result; and combining the linear business security risk prediction result and the non-linear business security risk prediction result, and obtaining the final business security risk prediction result through an activation function.

[0008] In some embodiments of the present invention, performing data preprocessing on the time series data to be observed includes: converting the data format of non-numerical data into numerical values, performing quantization processing on discrete data, and normalizing the data by scaling it into the interval [0, 1].

[0009] In some embodiments of the present invention, using the autoregressive integrated moving average model to evaluate the linear fitting significance of the divided linear time series data components includes: performing a stability test on the input linear time series data components, and for the time series data that fails the stability test, improving its stability through differencing operations; for the time series data that passes the stability test, using the autoregressive model and the moving average model to evaluate the linear fitting significance of the divided linear time series data components; wherein, using the autoregressive model to capture the autocorrelation of the time series data, using the observed values of past time steps to predict the current value, using the moving average model to capture the moving average part of the time series data, using the errors of past time steps to predict the current value, and evaluating the linear fitting significance by comparing the predicted current value with the true current value.

[0010] In some embodiments of the present invention, before using the multi-layer stacked long short-term memory network to extract features from the non-linear time series data components, the method further includes: using the Ljung-Box module to perform white noise detection to evaluate the autocorrelation of the non-linear time series data components obtained after residual processing, and inputting the time series data passing through the Ljung-Box module into the multi-layer stacked long short-term memory network.

[0011] In some embodiments of the present invention, the multi-layer stacked long short-term memory network includes a first-layer long short-term memory network, a second-layer long short-term memory network, and a third-layer long short-term memory network with the number of units decreasing successively by a factor of 2n, where n is a positive integer; and the method of using the multi-layer stacked long short-term memory network to extract features from the non-linear time series data component and perform non-linear prediction to generate a non-linear service security risk prediction result includes: using the first-layer long short-term memory network to extract first-order features; passing the output of the first-layer long short-term memory network through a batch normalization layer and a Dropout layer, and using the second-layer long short-term memory network to extract second-order features; passing the output of the second-layer long short-term memory network through a batch normalization layer and a Dropout layer, and using the third-layer long short-term memory network to extract third-order features; splicing the first-order features, second-order features, and third-order features, and processing them through a fully connected layer and an activation function to obtain a non-linear service security risk prediction result.

[0012] In some embodiments of the present invention, the method further includes: a step of pre-training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, using historical time series data of a preset length as the training set; for the training set used to train the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, its preprocessing step further includes: copying the true values of the training set data and shifting them backward by one time period in the time gradient, and splicing the shifted true values onto the original data set.

[0013] In some embodiments of the present invention, the method further includes: obtaining time series data in the power trading environment in real time, and if it is monitored that the service security risk prediction result exceeds a preset threshold after obtaining the final service security risk prediction result through processing, an alarm is generated.

[0014] Corresponding to the above method, the present invention further provides a power trading service security risk prediction device based on time series detection, including a processor, a memory, and a computer program / instructions stored on the memory, where the processor is used to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method described in any one of the above embodiments.

[0015] Corresponding to the above method, the present invention further provides a computer-readable storage medium, on which computer program / instructions are stored, and when the computer program / instructions are executed by a processor, the steps of the method described in any one of the above embodiments are implemented.

[0016] Corresponding to the above method, the present invention further provides a computer program product, including computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the method described in any one of the above embodiments are implemented.

[0017] The power trading service security risk prediction method based on time series detection proposed by the present invention can evaluate the significance of the linear time series data component through the autoregressive integrated moving average model, so as to only select the time series data with good linear fitting significance for linear prediction, and process the remaining time series data according to the nonlinear time series data component for nonlinear prediction through residual processing, so as to split the time series data into linear and nonlinear parts for separate prediction, and comprehensively obtain the final business security risk prediction result. It is beneficial to improve the accuracy of the prediction result, and splitting it into linear and nonlinear parts helps to avoid the influence between data with different correlations.

[0018] Additional advantages, objects, and features of the present invention will be partially described below, and will become partially apparent to those of ordinary skill in the art after studying the following text, or can be learned according to the practice of the present invention. The objects and other advantages of the present invention can be achieved and obtained through the structure specifically pointed out in the specification and the drawings.

[0019] Those skilled in the art will understand that the objects and advantages that can be achieved by the present invention are not limited to the above specifically described, and the above and other objects that the present invention can achieve will be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention, form a part of this application, and do not limit the present invention. In the drawings:

[0021] Figure 1 It is a flowchart of the power trading service security risk prediction method based on time series detection in an embodiment of the present invention.

[0022] Figure 2 It is a schematic structural diagram of the LSTM module in an embodiment of the present invention.

[0023] Figure 3 It is a schematic structural diagram of the AR-LSTM algorithm in an embodiment of the present invention.

[0024] Figure 4 It is a schematic structural diagram of the three-layer stacked LSTM network in an embodiment of the present invention.

[0025] Figure 5 It is a schematic structural diagram of the computer device included in the power trading service security risk prediction device based on time series detection in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0026] To make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the embodiments and the drawings. Herein, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but not to limit the present invention.

[0027] Herein, it should also be noted that in order to avoid obscuring the present invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the present invention are shown in the drawings, while other details less related to the present invention are omitted.

[0028] It should be emphasized that the term "comprising / including" as used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0029] Herein, it should also be noted that if not otherwise specified, the term "connection" as used herein can not only refer to direct connection, but also represent indirect connection with an intermediate.

[0030] In the following, embodiments of the present invention will be described with reference to the drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0031] The business security risk prediction model based on timing detection is based on past time series for prediction to determine whether newly observed time series data is different from or the same as the past. Compared with the anomaly prediction at a single time point, the outliers in time series are mostly associated with an entire subsequence. These methods can be generally divided into two categories in terms of the selection of anomaly thresholds: The first category is the way of empirical threshold selection, which judges the anomaly range and selects the threshold through the expert knowledge and experience in the field, and subsequent threshold changes are also made manually; the other category is the dynamic threshold selection method, where the threshold changes according to the algorithm and specific data.

[0032] The business security risk detection methods based on time-series data selected based on empirical thresholds can generally be divided into three categories: distance-based, classification-based, and prediction-based. The most representative method among them is the K-Nearest Neighbor algorithm (KNN). KNN is a distance-based algorithm used for classification and regression problems. In the KNN algorithm, each data sample calculates an anomaly score based on the average distance between this sample and other samples. If the anomaly score exceeds the set threshold, then this sample is considered an abnormal sample. The time-series data business security risk detection methods based on dynamic threshold selection include various deep neural network models, such as deep generative models like AE (autoencoder) and VAE (variational autoencoder). Many researchers have conducted research and improvements based on neural networks and generative models, such as the SPOT and DSPOT algorithms, which are initialized with approximately 1000 data points and calculate the anomaly threshold in the streaming data through statistics. Now, the prediction methods based on time-series data combined with the currently developing neural networks have been widely applied in network security systems. By learning the time dependence and the mutual relationships between variables, it is possible to analyze and predict the information with business security risks more effectively and accurately. Optionally, the business security risk detection model can also select algorithms such as KNN, RF, SGAD-GAN, SPOT, and DSPOT.

[0033] Based on the above analysis, an ideal business security risk prediction method for the power trading system should achieve the following design goals: (1) realizing the statistical analysis of the time-series data of the network traffic in the power trading system; (2) maintaining a high prediction accuracy for abnormal data in a complex trading network environment; (3) being able to perform real-time detection and monitoring of time-series data including network traffic data, and being able to generate an alarm when there is a trend of abnormal data occurrence.

[0034] Therefore, the present invention proposes a more effective and higher-prediction-accuracy business security risk prediction method based on the current business security risk monitoring framework. In the power trading environment, it combines the LSTM and ARIMA algorithms for business security risk prediction, aiming to optimize the business security risk detection effect in a complex network traffic environment, and evaluates the business security risk detection performance of this method in different situations through actual experimental simulations.

[0035] The network environment and network users in the power trading system are highly complex, making it difficult to conduct unified research on users and the network environment. At the same time, various business security risk prediction models do not extract sufficient features for different characteristics in multivariate time series, and there is insufficient long-span time dependence. Finally, the limitations of a single model have a greater impact on the prediction accuracy. Therefore, it is necessary to design a more effective and higher-prediction-accuracy business security risk prediction method based on the current business security risk monitoring framework.

[0036] The present invention proposes a method and device for predicting security risks of power trading services based on time series detection. The key innovation points are as follows: (1) By using window feature preprocessing and linear and nonlinear filtering to capture the spatio-temporal correlation of time series data, the ARIMA and multi-layer LSTM networks are combined into an AR-LSTM model. By adopting a combined model, the linear and nonlinear patterns of time series data are distinguished; (2) The Ljung-Box is used to perform a significance test on the entire data to determine whether the ARIMA model itself can significantly and effectively fit the sequence information. After the time series data is fitted, the Ljung-Box white noise detection can be used to screen out the nonlinear patterns; (3) The nonlinear patterns are handed over to the multi-layer LSTM for processing. Through the combined network structure and linear and nonlinear pattern filtering, the long-term change trend of the time series can be obtained, and the spatio-temporal correlation between sequence variables can also be captured.

[0037] The above key innovation points make this solution more suitable for processing time series data with complex data characteristics, and the processing results have high accuracy.

[0038] Figure 1 It is a flowchart of the method for predicting security risks of power trading services based on time series detection in an embodiment of the present invention. The method for predicting security risks of power trading services based on time series detection proposed by the present invention includes the following steps:

[0039] Step S110: Perform data preprocessing on the time series data to be observed in the power trading system, and preliminarily divide out the linear time series data components from the time series data.

[0040] In the specific implementation process, in the power trading system, the time series data includes time series traffic data and / or time series service data, and whether there are service security risks in the power trading system is predicted based on the time series data related to the service in the power trading system.

[0041] Step S120: Use the autoregressive integrated moving average model to evaluate the linear fitting significance of the divided linear time series data components, and perform linear prediction on the time series data with linear fitting significance exceeding the preset threshold in the linear time series data components to generate a linear service security risk prediction result.

[0042] Step S130: Perform residual processing on the time series data to be observed and the time series data with linear fitting significance exceeding the preset threshold in the linear time series data components to obtain the nonlinear time series data components.

[0043] Step S140: Extract features from the non-linear time series data component by using a multi-layer stacked long short-term memory network, and perform non-linear prediction to generate a non-linear business security risk prediction result.

[0044] Step S150: Combine the linear business security risk prediction result and the non-linear business security risk prediction result, and obtain the final business security risk prediction result through an activation function.

[0045] By using the power trading business security risk prediction method based on time series detection proposed by the present invention, the significance of the linear time series data component can be evaluated through an autoregressive integrated moving average model, so that only the time series data with good linear fitting significance is selected for linear prediction, and the remaining time series data is non-linearly predicted according to the non-linear time series data component through residual processing. Thus, the time series data is split into linear and non-linear parts for separate prediction, and the final business security risk prediction result is comprehensively obtained. This is beneficial to improving the accuracy of the prediction result, and splitting it into linear and non-linear parts helps to avoid the influence between data with different correlations.

[0046] In some embodiments of the present invention, the data preprocessing of the time series data to be observed includes: converting the non-numerical data format into numerical values, quantifying the discrete data, and normalizing the data by scaling it into the interval [0, 1].

[0047] In the specific implementation process, the time series data is preprocessed in the way of window feature preprocessing. When processing the time series data, a continuous period of time data can be divided into multiple windows with a fixed length, and each window represents an independent sample. This can capture the dynamic characteristics of the data changing over time, and make the data more suitable for subsequent feature extraction and model training.

[0048] By adopting this embodiment, the training set, test set or the time series data to be observed can be preprocessed in advance. The preprocessed time series data is beneficial to subsequent steps such as efficient model training and feature extraction, and is beneficial to realizing fast business security risk prediction.

[0049] In some embodiments of the present invention, in step S120, evaluating the linear fitting significance of the divided linear time series data component by using an autoregressive integrated moving average model includes: performing a stability test on the input linear time series data component, and for the time series data that fails the stability test, performing difference operation to improve its stability; for the time series data that passes the stability test, using an autoregressive model and a moving average model to evaluate the linear fitting significance of the divided linear time series data component. Among them, the autoregressive model is used to capture the autocorrelation of the time series data, and the observed values of past time steps are used to predict the current value. The moving average model is used to capture the moving average part of the time series data, and the errors of past time steps are used to predict the current value. The linear fitting significance is evaluated by comparing the predicted current value with the true current value.

[0050] Adopting this embodiment is beneficial to evaluating the linear fitting significance of the linear time series data component by using an autoregressive integrated moving average model, and moreover, improving the stability of the time series data through difference processing.

[0051] In some embodiments of the present invention, before using the multi-layer stacked long short-term memory network to extract features from the non-linear time series data component, the method further includes: using the Ljung-Box module to perform white noise detection to evaluate the autocorrelation of the non-linear time series data component obtained after residual processing, and inputting the time series data passing through the Ljung-Box module into the multi-layer stacked long short-term memory network.

[0052] Adopting this embodiment can use the Ljung-Box module to detect the autocorrelation of the non-linear time series data component, can measure the linear relationship between the values of the time series at different time points, can verify the extraction effect of the non-linear time series data component, and is beneficial to ensuring the accuracy of non-linear prediction.

[0053] In some embodiments of the present invention, the multi-layer stacked long short-term memory network includes a first-layer long short-term memory network, a second-layer long short-term memory network, and a third-layer long short-term memory network with the number of units decreasing successively by 2n times, where n is a positive integer. In some other embodiments of the present invention, it can also decrease successively by 2 n times.

[0054] Correspondingly, when extracting features from the non-linear time series data components using a multi-layer stacked long short-term memory network and performing non-linear prediction to generate a non-linear business security risk prediction result, it includes: (1) extracting first-order features using the first-layer long short-term memory network; (2) passing the output of the first-layer long short-term memory network through a batch normalization layer and a Dropout layer, and extracting second-order features using the second-layer long short-term memory network; (3) passing the output of the second-layer long short-term memory network through a batch normalization layer and a Dropout layer, and extracting third-order features using the third-layer long short-term memory network; (4) concatenating the first-order features, second-order features, and third-order features, and through the processing of a fully connected layer and an activation function, obtaining the non-linear business security risk prediction result.

[0055] Adopting this implementation method, it is possible to use a multi-layer long short-term memory network with a decreasing scale for feature extraction, which is beneficial to solving the problems that a single-layer LSTM network is prone to overfitting and has weak feature adaptability. By using a batch normalization layer and a Dropout layer, the robustness of the model itself is enhanced and the risk of model overfitting is reduced, improving the accuracy of the business security risk prediction result.

[0056] In some embodiments of the present invention, the method further includes: the step of pre-training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, using historical time series data of a preset length as the training set; for the training set used to train the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, its preprocessing step further includes: copying the true value of the training set data and shifting it backward by one time period in the time gradient, and splicing the shifted true value onto the original data set.

[0057] Adopting this implementation method, the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network can be pre-trained based on historical data, which can save the required time in the test stage and the actual business security risk prediction stage.

[0058] In some embodiments of the present invention, the method further includes: obtaining time series data in the power trading environment in real time. After processing to obtain the final business security risk prediction result, if it is monitored that the business security risk prediction result exceeds the preset threshold, an alarm is generated.

[0059] Adopting this implementation method, it is possible to detect abnormal situations with business security risks in the power trading environment, aiming to optimize the business security risk detection effect in a complex network traffic environment.

[0060] In some embodiments of the present invention, the Long Short-Term Memory (LSTM) network used in the multi-layer stacked long short-term memory network is a type of RNN. Generally, the recurrent neural network has a chain form that repeats the neural network, so it is very effective in processing long sequence data. However, when the data sample is too large, the recurrent neural network is prone to problems of gradient disappearance or explosion during learning and training. The long short-term memory network uses a long short-term memory module (referred to as the LSTM module) to overcome the above problems existing in the general recurrent neural network.

[0061] Figure 2 FIG. is a schematic structural diagram of the LSTM module in an embodiment of the present invention. The LSTM module controls the input and output information through a designed threshold structure, and adds three threshold functions (input gate, output gate, and forget gate) on the basis of the RNN to control the information flow process. Its structure is as Figure 2 shown.

[0062] Among them, x t and h t are respectively the input and output of the memory cell at time t, and c t represents the state value of the next cell. The forget gate f is responsible for clearing the information to be forgotten in the previous memory cell c t-1 ; the input gate i calculates the decision update value i L and the state of the next cell c t . By calculating through the forget gate, input gate, and C t , the required state value can be continuously passed on; h t is the output value of the cell, which is calculated and determined by the output gate o.

[0063] The calculation methods of each threshold function are as follows:

[0064]

[0065] Among them, σ is the activation function of each gate, C t is the candidate state of the cell at time t, W is the corresponding weight matrix, b is the corresponding bias term, and tanh is the activation function.

[0066] In some embodiments of the present invention, the adopted ARIMA model combines the autoregressive (Autoregressive Model, abbreviated as AR) model, the difference (I) model, and the moving average (Moving Average, MA) model. The model is usually expressed in the form of ARIMA(p, d, q).

[0067] The working process of the ARIMA model includes: (1) Since time series data may be non-stationary (the mean, variance, or autocorrelation changes over time), the ARIMA model performs differencing (I) operations to obtain stationary time series data; (2) For time series data that meets the requirements of the stability test, the autoregressive (AR) model is used to capture the autocorrelation of the time series data, and the observations at past time steps are used to predict the current value; (3) The ARIMA model attempts to capture the moving average (MA) part of the time series data, and the errors at past time steps (the differences between the observations and the previous predicted values) are used to predict the current value.

[0068] The ARIMA model first performs d-order differencing on the original sequence y t and denotes it as diff d y t to make the original sequence y t stationary. After that, in the autoregressive process of ARIMA, the data volume at the current moment is only related to the data volume at the previous moment and the perturbation at the current moment, and can be expressed as where y t is the value at the current time t, μ is the constant term, γ i is the autocorrelation coefficient, ε t is the perturbation term at time t, and p is the autoregressive order. In the moving average model of ARIMA, the data volume at the current moment is related to the perturbations that entered the system at the previous moment, so it is necessary to perform a moving average on the error terms, and it can be expressed as where θ i is the moving average coefficient and q is the moving average order. ARIMA combines the above steps to establish the relationship between the data at the current moment, the historical data, and the model perturbations. Its overall expression is:

[0069] Figure 3 is the structural schematic diagram of the AR-LSTM algorithm in an embodiment of the present invention. In the specific implementation process, in order to achieve the design goal of the ideal power trading system business security risk prediction method, the present invention proposes a business security risk prediction method that combines LSTM and ARIMA in the power trading environment, and defines this business security risk prediction algorithm as the AR-LSTM algorithm. The specific process of this method is as Figure 3 shown.

[0070] In Figure 3 the shown embodiment of the invention, this method includes the following steps:

[0071] (1) Perform model preprocessing. Before applying the business security risk prediction method based on AR-LSTM, it is necessary to perform data preprocessing operations on the training set and the test set first. The data preprocessing includes the following: (1) First, convert the format of all non-numerical data. For example, encode and convert data such as protocols, statuses, and attack types into floating-point types, and perform quantization processing on all discrete data to make the features easier to analyze and process. (2) Normalize all data to the interval [0, 1] to improve the accuracy and convergence speed of the model. (3) Copy the true values of the training set data, shift them backward by one time period on the time gradient, and splice them as new true values to the original data set. That is, for any time t, assuming that the original data set has κ-dimensional features, then use the original data X1(t - 1)~X κ (t - 1) as the input, and the last column X κ (t) as the output data to obtain a training data set with a closer time relationship.

[0072] During the process of feature preprocessing, perform the division of linear mode and non-linear mode. Generally speaking, the time series data X can be regarded as a set of random variables that only change with time, and is composed of the linear time series data component X l and the non-linear time series data component X n , and can be expressed as X = X l +X n . After the output is optimized through feature analysis, it can be divided into several linear time series data components X l and non-linear time series data components X n .

[0073] (2) The ARIMA module in the AR-LSTM model makes predictions based on the linear time series data component, and obtains the time series data X arima with a significantly effective linear fit in the output. Based on X arima , through parameter estimation, model diagnosis, and classification prediction, the linear business security risk prediction result Y l is obtained. X arima and the non-linear part time series data component d X obtained after residual calculation, and its calculation formula is d X =X - X arima . Both AR and MA in ARIMA are linear models, and it is easy to obtain information about the linear pattern from the time series. The ARIMA model can perform significance detection on the entire data to determine whether the ARIMA model itself can significantly and effectively fit the sequence information. After fitting the sequence, the linear components in the data can be screened out and the prediction result can be obtained. Only the non-linear time series data d X is retained in the residual part of the model.

[0074] (3) Ljung-Box white noise detection. For the non-linear time series data d X Perform Ljung-Box white noise detection to determine whether the sequence obtained through residual calculation is a white noise sequence, so as to determine whether the non-linear information is successfully extracted. Ljung-Box white noise detection is a detection step, and d X is the residual sequence that has not been detected yet. If it passes this detection, its representation symbol will be modified to X n . The calculation formula for the statistic of the Ljung-Box test is: where n is the input sample size, m is the set range, and ρ i is the autocorrelation coefficient of the i-th order. When the calculated LB > 0.05, it indicates that the residual sequence d X is a white noise sequence, and the ARIMA model has a good fitting effect on the linear sequence; on the contrary, when LB < 0.05, it indicates that the effect of this non-linear information extraction is not good.

[0075] (4) Use the time series data X of the non-linear pattern that has passed the Ljung-Box white noise detection n as the input of the multi-layer stacked LSTM network to optimize feature extraction, and obtain the output non-linear service security risk prediction result Y n .

[0076] (5) Finally, add the output Y l of the ARIMA module and the output Y n of the LSTM module, and pass through the activation function ReLU and the Softmax layer to obtain the classification prediction result Y. The calculation formula is Y = Y l + Y n .

[0077] In the specific implementation process, in the multi-layer stacked LSTM, an LSTM network with a three-layer stacked structure can be used to optimize the LSTM model, which is beneficial to solving the problems of easy overfitting and weak feature adaptability of the single-layer LSTM network. Its structure is as Figure 4 shown, Figure 4 which is the structural schematic diagram of the three-layer stacked LSTM network in an embodiment of the present invention.

[0078] Figure 4 The process shown includes: the residual sequence X that has passed the detection n (X nThat is, for the non-linear time series data component, first, the first-order features are obtained through the first layer of LSTM with 256 units; then the feature output will pass through the batch normalization layer and the Dropout layer for optimization to enhance the robustness of the model itself and reduce the risk of overfitting of the model. The optimized data will be input into the second layer of LSTM with 128 units to obtain the second-order features; similarly, after passing through the batch normalization layer and the Dropout layer for optimization again, the data will be input into the third LSTM layer with 64 units to obtain the third-order features. The first-order features, second-order features, and third-order features will finally be input into the fully connected layer to obtain 32-dimensional features, and finally, a layer of Softmax is used for classification to extract vectors with dimensions equal to the number of target classes, and the non-linear service security risk prediction result Y is obtained. n 。

[0079] In addition, since the prediction model is a classification prediction model, the non-linear service security risk prediction result Y n can also be called the non-linear abnormal traffic classification prediction result or the abnormal traffic classification prediction result. Furthermore, the classification prediction model can be a binary classification prediction model.

[0080] Above, a method and device for predicting the security risk of power trading services based on time series detection proposed by the present invention combines the autoregressive integrated moving average model ARIMA and the multi-layer stacked long short-term memory network Multi-LSTM, and the whole is named the AR-LSTM model. Compared with the prior art, the AR-LSTM model can improve the accuracy, precision, recall rate, and root mean square error of the binary classification detection result and the multi-classification detection result.

[0081] By using the method for predicting the security risk of power trading services based on time series detection proposed by the present invention, the significance of the linear time series data component can be evaluated through the autoregressive integrated moving average model, so that only the time series data with good linear fitting significance is selected for linear prediction, and the remaining time series data is non-linearly predicted according to the non-linear time series data component through residual processing, so that the time series data is split into linear and non-linear parts for separate prediction, and the final service security risk prediction result is comprehensively obtained. This is beneficial to improving the accuracy of the prediction result, and splitting into linear and non-linear parts helps to avoid the influence between data with different correlations.

[0082] In order to further verify the performance of the AR-LSTM model proposed in this scheme, a control was set up through a simulation experiment method. The public dataset UNSW-NB15 includes a total of nine types of data traffic with service security risks. After training the AR-LSTM model through the pytorch training framework, a detailed test was carried out on the dataset UNSW-NB15. The specific test process is as follows:

[0083] First, in the binary classification comparison experiment where the 9 types of attacks in the dataset are merged into traffic with business security risks and distinguished from normal traffic, the AR-LSTM method achieved the highest accuracy rate, reaching 93.56%. The detection accuracy rate of the original LSTM network structure without modification was only 86.35%. The classification effect of the AR-LSTM model is very excellent. In the multi-classification comparison experiment on the nine types of data traffic with business security risks and normal types in the dataset, the prediction accuracy rate of the AR-LSTM method is also higher than other methods of the same type, reaching 87.38%.

[0084] It can be seen from the experimental results that compared with other security risk prediction schemes based on time series detection, AR-LSTM is more suitable for processing complex multi-source time series traffic data such as UNSW-NB15, and is more applicable to the more complex network environment and higher-dimensional data streams in the current power trading system. Therefore, overall, the AR-LSTM method is an efficient method for predicting business security risks in a power trading system with excellent classification effect and applicable to complex network environments.

[0085] Corresponding to the above method, the present invention also provides a power trading business security risk prediction device based on time series detection. The system includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the system implements the steps of the method described above.

[0086] Figure 5 It is a schematic diagram of the computer device structure included in the power trading business security risk prediction device based on time series detection in an embodiment of the present invention. Refer to Figure 5 , the computer device 00 includes: a processor 01, a memory 02, and a computer program stored on the memory 02 and executable on the processor 01. When the processor 01 executes the computer program, it implements the human factor data server access control method provided in the above method embodiment.

[0087] Among them, the processor 01 is connected to the memory 02, such as through a bus 03. The processor 01 can be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logic blocks, modules, and circuits described in connection with the disclosure of this application. The processor 01 can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The bus 03 can include a path for transmitting information between the above components. The bus 03 can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 130 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 only a thick line is used to represent it in Figure 5 , but it does not mean that there is only one bus or one type of bus. The memory 02 is used to store a computer program corresponding to the human factor data server access control method of the above embodiments of this application, and this computer program is controlled and executed by the processor 01. The processor 01 is used to execute the computer program stored in the memory 02 to implement the content shown in the foregoing method embodiments.

[0088] Corresponding to the above method, the present invention also provides a computer-readable storage medium, on which a computer program / instructions are stored, and when the computer program / instructions are executed by a processor, the steps of the method described in any one of the above embodiments are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), an internal memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0089] Corresponding to the above method, the present invention also provides a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the method described in any one of the above embodiments are implemented.

[0090] Those of ordinary skill in the art should understand that the various exemplary components, systems, and methods described in connection with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Specifically, whether to implement it in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, and so on. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium or transmitted through a data signal carried in a carrier wave on a transmission medium or a communication link.

[0091] It should be clear that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order between steps after understanding the spirit of the present invention.

[0092] In the present invention, the features described and / or exemplified for one embodiment can be used in the same or a similar manner in one or more other embodiments, and / or combined with the features of other embodiments or replace the features of other embodiments.

[0093] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, various changes and variations can be made to the embodiments of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for predicting security risks of power trading business based on time series detection, characterized in that: include: Preprocessing the time series data to be observed in the power trading system, and preliminarily dividing the linear time series data components from the time series data; The linear fitting significance of the divided linear time series data components is evaluated by using an autoregressive integrated moving average model, and a linear business security risk prediction result is generated by performing linear prediction based on the time series data whose linear fitting significance in the linear time series data components exceeds a preset threshold value; Performing residual processing on the time series data to be observed and the time series data whose linear fitting significance exceeds a preset threshold in the linear time series data component to obtain a nonlinear time series data component; Extracting features from the nonlinear time series data components using a multi-layer stacked long short-term memory network, and performing nonlinear prediction to generate a nonlinear business security risk prediction result; The linear business security risk prediction result and the nonlinear business security risk prediction result are combined and the final business security risk prediction result is obtained through an activation function.

2. The method according to claim 1, characterized in that Data preprocessing for the observed time series data includes: converting non-numeric data formats into numeric values, quantizing discrete data, and scaling the data to the [0, 1] interval for normalization.

3. The method according to claim 1, characterized in that The step of evaluating the linear fitting significance of the divided linear time series data components by using an autoregressive integrated moving average model comprises: Performing a stability test on the input linear time series data components, and performing a differential operation on the time series data that fails the stability test to improve its stability; For the time series data that pass the stability test, the linear fitting significance of the divided linear time series data components is evaluated using an autoregressive model and a moving average model; Among them, the autoregressive model is used to capture the autocorrelation of time series data, the observed values ​​of past time steps are used to predict the current value, the moving average model is used to capture the moving average part of the time series data, the error of past time steps is used to predict the current value, and the significance of linear fit is evaluated by comparing the predicted current value with the actual current value.

4. The method according to claim 1, characterized in that Before extracting features from the nonlinear time series data component using a multi-layer stacked long short-term memory network, the method further includes: The Ljung-Box module is used to perform white noise detection to evaluate the autocorrelation of the nonlinear time series data components obtained after residual processing, and the time series data passing through the Ljung-Box module is input into the multi-layer stacked long short-term memory network.

5. The method according to claim 1, characterized in that The multi-layer stacked long short-term memory network includes a first layer long short-term memory network, a second layer long short-term memory network and a third layer long short-term memory network, wherein n is a positive integer; The method of extracting features from the nonlinear time series data components by using a multi-layer stacked long short-term memory network and performing nonlinear prediction to generate a nonlinear business security risk prediction result includes: The first-order features are extracted using the first-layer long short-term memory network; The output of the first-layer LSTM network is passed through a batch normalization layer and a dropout layer, and the second-order features are extracted using the second-layer LSTM network. The output of the second-layer LSTM network is passed through a batch normalization layer and a dropout layer, and the third-order features are extracted using the third-layer LSTM network. The first-order features, second-order features, and third-order features are concatenated and processed by a fully connected layer and an activation function to obtain nonlinear business security risk prediction results.

6. The method according to claim 1, characterized in that The method further comprises: The step of pre-training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, using historical time series data of a preset length as a training set; For the training set used to train the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, the preprocessing step also includes: copying the true value of the training set data, and shifting it back a time period on the time gradient, and splicing the shifted true value to the original data set.

7. The method according to claim 1, characterized in that The method also includes: acquiring time series data in a power trading environment in real time, and after processing to obtain a final business security risk prediction result, generating an alarm if it is monitored that the business security risk prediction result exceeds a preset threshold.

8. A device for predicting security risks of power trading business based on time series detection, comprising a processor, a memory and a computer program / instruction stored in the memory, characterized in that: The processor is used to execute the computer program / instructions. When the computer program / instructions are executed, the device implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method as claimed in any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images