Power grid abnormal flow detection method based on multi-modal data fusion

Abstract

The invention discloses a power grid abnormal flow detection method based on multi-modal data fusion, and the method comprises the steps: collecting the multi-source heterogeneous data of a power grid through an edge calculation node, including the current waveform of an intelligent electric meter, the state variable of an SCADA system, network protocol metadata and an equipment log event; performing space-time alignment preprocessing on the original data, converting an unstructured log into a time sequence by adopting a sliding window mechanism, and eliminating sensor noise through an LSTM auto-encoder; constructing a multi-dimensional feature space which comprises a frequency domain feature, a spatial-temporal feature and a protocol feature, and obtaining a feature vector; the feature vectors are input into a hybrid detection model, the model is composed of an isolated forest algorithm, an improved CNN-LSTM classifier and an information entropy-based rule engine which are connected in parallel, and a dynamic weight fusion strategy is adopted to output an abnormal probability; and when the abnormal probability exceeds a dynamic threshold, triggering a multi-level response mechanism: sending a traffic shaping instruction to the edge device, generating a device fingerprint portrait on the cloud platform, and storing abnormal event features through a block chain.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid anomaly detection, and more specifically, to a power grid abnormal traffic detection method based on multi-modal data fusion. Background Art

[0002] With the rapid development of smart grids, the power system has gradually formed a complex heterogeneous network including smart meters, SCADA systems, network communication devices, and distributed energy sources. The multi-source data generated in this network (such as current waveforms, device status variables, network protocol traffic, log events, etc.) has characteristics such as high dimensionality, multi-modality, and strong spatio-temporal correlation, which poses challenges for abnormal traffic detection.

[0003] The publication number is CN111092862A, and the name is a method and system for detecting abnormal communication traffic of power grid terminals. It obtains the network communication topologies of multiple terminals and the master station, bypass extracts the network traffic of multiple terminals to obtain network traffic data packets; according to the traffic feature model, combined with the real-time traffic data of each terminal, calculates the first traffic anomaly index of each terminal; when the first traffic anomaly index is greater than the set first threshold, it determines that the traffic of the terminal is abnormal; or when the first traffic anomaly index is less than the set first threshold, it parses the network traffic data packets of multiple terminals, and according to the packet feature model and the parsing data of the network traffic data packets of multiple terminals, calculates the second traffic anomaly index of each terminal; according to the determined weights of the first traffic anomaly index and the second traffic anomaly index, calculates the comprehensive traffic anomaly index; when the comprehensive traffic anomaly index is greater than the set second threshold, it determines that the traffic of the terminal is abnormal.

[0004] The publication number is CN109886833A, and the name is a deep learning method for detecting abnormal traffic of smart grid servers. This method is based on monitoring the high-dimensional time series data information of the traffic of smart grid servers, and uses an Encoder-Decoder deep neural network based on two-layer LSTM neurons to construct an estimation of the normal traffic state. Based on the estimated normal traffic behavior, it analyzes the distribution of the residuals between the estimated value and the measured value, and finally gives a confidence interval as the control limit for discriminating abnormal behavior, thus realizing the detection of abnormal traffic behavior of smart grid servers.

[0005] The current power grid anomaly detection technology mainly has the following limitations:

[0006] Insufficient single-modal detection ability: Traditional methods are mostly based on a single data source (such as network traffic or device logs), and do not fully integrate multi-dimensional information such as power physical quantities, communication protocols, and device behaviors, making it difficult to identify cross-modal covert attacks (such as data tampering with industrial control protocols).

[0007] Data heterogeneity handling defects: The timestamps of multi-source data are asynchronous, the spatial distribution is discrete, and noise interference (such as sensor drift) makes it difficult to align features. Existing preprocessing methods (such as fixed-threshold filtering) are difficult to balance real-time performance and denoising effect.

[0008] Poor adaptability of static detection models: Using traditional machine learning (such as Isolation Forest) or a single deep learning model (such as LSTM) in isolation, lacking a dynamic weight mechanism, the false alarm rate increases when facing dynamic load changes and new attack patterns in the power grid.

[0009] Fragmented response mechanism: Existing solutions are mostly limited to single disposal means (such as traffic blocking), lacking a multi-level closed-loop response of edge-cloud collaboration, and there are problems with insufficient data credibility in tracing abnormal events.

[0010] Therefore, how to provide a power grid abnormal traffic detection method based on multi-modal data fusion is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0011] In view of this, the present invention provides a power grid abnormal traffic detection method based on multi-modal data fusion, aiming to solve the technical problems of insufficient single-modal detection ability, data heterogeneity handling defects, poor adaptability of static detection models, and fragmented response mechanisms.

[0012] To achieve the above object, the present invention adopts the following technical solutions:

[0013] A power grid abnormal traffic detection method based on multi-modal data fusion, comprising the following steps:

[0014] S1. Real-time collect multi-source heterogeneous data of the power grid through edge computing nodes, including smart meter current waveforms, SCADA system status variables, network protocol metadata, and device log events;

[0015] S2. Perform spatio-temporal alignment preprocessing on the original data, use a sliding window mechanism to convert unstructured logs into time series, and eliminate sensor noise through an LSTM autoencoder;

[0016] S3. Construct a multi-dimensional feature space, including frequency domain features, spatio-temporal features, and protocol features, to obtain feature vectors;

[0017] S4. Input the feature vectors into a hybrid detection model, which is composed of a parallel Isolation Forest algorithm, an improved CNN-LSTM classifier, and a rule engine based on information entropy, and use a dynamic weight fusion strategy to output the abnormal probability;

[0018] S5. When the abnormal probability exceeds the dynamic threshold, trigger a multi-level response mechanism: send a traffic shaping instruction to the edge device, generate a device fingerprint portrait on the cloud platform, and store the characteristics of the abnormal event through blockchain

[0019] Further, the specific content of S1 is as follows:

[0020] The edge computing node establishes a communication connection with the smart meter, performs data interaction using the communication protocol, and periodically obtains the current waveform data from the smart meter at a set time interval;

[0021] The edge computing node obtains the status variable data of the power grid equipment from the server or workstation of the SCADA system. The collected status variables include voltage, current, power, frequency, and phase angle;

[0022] The edge computing node captures and analyzes the data packets in the power grid communication network at the network layer, extracts the network protocol metadata. The collected metadata includes the source IP address, destination IP address, port number, protocol type, data packet length, and transmission timestamp of the data packet. By deploying a data packet capture tool at the network node or using the mirror port function of the network device, the network traffic data is sent to the edge computing node for processing;

[0023] The edge computing node establishes a log collection channel with various devices in the power grid, adopts log protocols such as Syslog and SNMP Trap to receive the log events generated by the devices. The log collection is event-driven, that is, when a specific event occurs on the device, it actively sends a log message to the edge computing node.

[0024] Further, the edge computing node in S1 adopts a lightweight data cleaning strategy, including outlier removal based on adaptive Kalman filtering and redundant data compression based on the device topology structure;

[0025] The specific content of the outlier removal based on adaptive Kalman filtering is as follows:

[0026] Initialize the Kalman filter parameters, including the initial value of the state variable, state transition matrix, observation matrix, process noise covariance matrix, and observation noise covariance matrix. Perform point-by-point filtering on the real-time collected data. At each time step, calculate the Kalman gain according to the current observation value and prediction value, update the state variable estimate value and the error covariance matrix, set the outlier judgment threshold, and when the deviation between the observation value and the estimate value exceeds this threshold, determine that the observation value is an outlier and remove it;

[0027] Further, the specific content of the redundant data compression based on the device topology structure is as follows:

[0028] Construct the topological structure diagram of power grid equipment, and obtain the connection relationships and data interaction paths between various equipment. Analyze the relevance between equipment, determine the data redundancy areas, and compress the redundant data using data compression algorithms according to the topological structure and data correlation. For structured data, use dimensionality reduction algorithms such as principal component analysis to extract the main feature components, remove the redundant dimensional information, and at the same time retain the main change trends and key information of the data. For semi-structured or unstructured data, use rule-based pattern matching and summary generation methods to extract representative log patterns and key event information, and compress the lengthy log text data.

[0029] Further, the specific content of S2 is as follows:

[0030] Set a time reference, and based on the timestamps recorded by smart meters and SCADA systems, sort all the collected multi-source data in terms of time, align the data from different sources within the same or similar time intervals to the same time dimension, and correlate the data collected from different geographical locations or device nodes in the spatial dimension based on the geographical topological structure of the power grid and the physical connection relationships between devices;

[0031] Set the window size and sliding step, divide the unstructured device log event data collected by the edge computing nodes according to the defined sliding window, extract various log events occurring within the window, and convert them into a structured vector form;

[0032] Design an LSTM network structure as an autoencoder, and use the data preprocessed by spatio-temporal alignment to train the LSTM autoencoder. During the training process, aim to minimize the reconstruction error between the input original data and the output data of the autoencoder, and optimize the network parameters through the backpropagation algorithm. After the training is completed, use the trained autoencoder to reconstruct the input data, and use the reconstructed data to replace the original data to eliminate the noise interference introduced during the sensor or other acquisition processes.

[0033] Further, the specific content of S3 is as follows:

[0034] Extract the spectral energy distribution of each phase current through improved wavelet packet transform to obtain frequency-domain features, use spatio-temporal graph convolutional networks to extract the behavior patterns of device groups to obtain spatio-temporal features, and extract the abnormal function code combinations of Modbus / TCP sessions based on deep packet parsing to obtain protocol features;

[0035] Normalize the current waveform data after spatio-temporal alignment preprocessing and noise reduction processing, map the data to the interval [0, 1], determine the optimal decomposition level through an adaptive decomposition level selection algorithm according to the characteristics and spectral distribution characteristics of the current signal. During the decomposition process, calculate the energy entropy value of each node, and dynamically determine the optimal decomposition scale according to the size of the energy entropy value. For a certain phase current signal, decompose it into sub-signals of multiple frequency bands through wavelet packet transform, then calculate the energy of the signal in each frequency band, and normalize it to obtain the energy distribution vector of each frequency band, which is used as the frequency domain feature of the phase current;

[0036] According to the topological structure of the power grid and the physical connection relationship between devices, construct a spatio-temporal graph. The nodes in the graph represent various devices in the power grid, indicating the electrical connection relationship or data interaction relationship between devices. Introduce the time dimension into the graph structure, and use the sliding window mechanism to take the data of multiple consecutive time points as a spatio-temporal segment. Each spatio-temporal segment corresponds to a spatio-temporal graph. The node attributes in the graph include the state variables of the device within the time window and the spectral energy distribution characteristics obtained from the frequency domain feature extraction step. Input the constructed spatio-temporal graph into the spatio-temporal graph convolutional network ST-GCN for feature extraction to obtain spatio-temporal features;

[0037] Deeply analyze the collected network protocol metadata. The analysis content includes the header information, function code, and data field of the message. By analyzing the function code, obtain the communication operation type between power grid devices. By analyzing the data field, obtain the specific communication data content. Based on the results of deep packet parsing, statistically analyze the occurrence frequency, combination order of function codes in the Modbus / TCP session, and the correlation relationship with other protocol fields. By establishing a normal function code combination pattern library, compare the function code combinations in the actual session with the normal pattern library to identify abnormal function code combinations.

[0038] Further, the specific content of S4 is as follows:

[0039] Input the feature vector into the hybrid detection model, calculate the confidence index in real time. According to the calculated confidence index, construct a fuzzy membership function for each detector, optimize the weighting coefficients of each detector based on the particle swarm optimization algorithm, and perform weighted fusion on the abnormal probabilities output by the three detectors according to the optimized weighting coefficients to obtain the final abnormal probability output result.

[0040] Further, the hybrid detection model includes the isolation forest algorithm detection, the improved CNN-LSTM classifier detection, and the rule engine detection based on information entropy;

[0041] The specific content of the isolation forest algorithm detection is as follows:

[0042] Multiple isolated trees are constructed to detect abnormal data points. When constructing the isolated trees, a feature subset and a split value are randomly selected to make the path length of the data points in the tree structure as short as possible. Abnormal data points have a shorter average path length. For each isolated tree, the path length of the input feature vector in the tree is calculated, and then the average value of the path lengths of all isolated trees is taken. According to the relationship between the average path length and the dataset size, the input feature vector is mapped into the abnormal score interval of [0, 1]. The closer the abnormal score is to 1, the greater the probability that the sample corresponding to the feature vector is abnormal traffic.

[0043] The detection of the improved CNN-LSTM classifier is specifically as follows:

[0044] The CNN module composed of the convolutional layer and the pooling layer is used to extract features from the reshaped feature vector. The convolutional layer slides the convolutional kernel in the time dimension to extract the feature patterns of the feature vector in the local time window. The pooling layer then performs dimensionality reduction and feature selection on the extracted features to retain the main feature information. The feature sequence extracted by the CNN is input into the LSTM layer. The LSTM unit models the time series data through the gating mechanism. A fully connected layer and an activation function are added after the LSTM layer to map the feature vector output by the LSTM to the abnormal class probability distribution, and the probability values corresponding to normal traffic and abnormal traffic of the feature vector are output.

[0045] Furthermore, the detection of the rule engine based on information entropy is specifically as follows:

[0046] For the spectral energy distribution in the frequency domain features, the probability distribution of the energy values of each frequency band is calculated, and then the information entropy of the frequency domain features is calculated according to the information entropy formula. According to the predefined rule library, the calculated feature information entropy is matched with the rules in the rule library. The rule library contains the normal and abnormal feature information entropy thresholds or ranges set based on experience or prior knowledge. If the feature information entropy exceeds the normal range or meets the rule conditions of the abnormal pattern, it is determined that the sample corresponding to the feature vector is abnormal traffic, and the corresponding abnormal probability value is output.

[0047] Furthermore, for the three detectors of the isolation forest algorithm, the improved CNN-LSTM classifier, and the rule engine based on information entropy, calculate their confidence metrics in real time, including the area under the ROC curve AUC and the false positive rate FPR. According to the calculated confidence metrics, construct a fuzzy membership function for each detector. The fuzzy membership function maps the confidence metrics to the fuzzy membership degree interval of [0,1], indicating the credibility of the detector in the current state. For detectors with a high area under the ROC curve AUC and a low false positive rate FPR, their fuzzy membership degree is high, indicating that the detector has high reliability in the current detection task. Use the particle swarm optimization algorithm to dynamically adjust the weighting coefficients of each detector. Regard the weighting coefficients of each detector as the particle positions in the particle swarm, and use the detection performance of the fused anomaly probability as the optimization objective function. Through the iterative search process of the particle swarm, continuously update the positions and velocities of the particles to find the optimal combination of weighting coefficients, so that the fused anomaly probability has the best detection performance. Weight and fuse the anomaly probabilities output by the three detectors according to the optimized weighting coefficients to obtain the final output result of the anomaly probability.

[0048] The above technical solution at least includes the following technical effects:

[0049] The present invention discloses and provides a power grid abnormal traffic detection method based on multi-modal data fusion. Compared with the prior art, the present invention can solve the problems of data heterogeneity and noise through lightweight cleaning (adaptive Kalman filtering + topology compression) of edge computing nodes and denoising of LSTM autoencoders. Construct a multi-dimensional feature space using wavelet packet transform (frequency domain), ST-GCN (spatio-temporal), and deep packet parsing (protocol). Dynamically fuse the outputs of the isolation forest, CNN-LSTM, and rule engine through particle swarm optimization to improve the adaptability of the model. Combine edge traffic shaping, cloud portrait, and blockchain evidence storage to form a closed-loop response. Through multi-modal fusion and edge intelligence collaboration, the bottleneck of traditional detection methods in the complex environment of the power grid is broken through, and new threats such as APT attacks and data injection can be effectively dealt with. Brief Description of the Drawings

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0051] Figure 1 It is a schematic flowchart of a power grid abnormal traffic detection method based on multi-modal data fusion of the present invention. Detailed Embodiments

[0052] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0053] See the appendix Figure 1 , the embodiments of the present invention disclose a power grid abnormal traffic detection method based on multi-modal data fusion, including:

[0054] Real-time collection of multi-source heterogeneous data of the power grid through edge computing nodes. The edge computing nodes adopt a lightweight data cleaning strategy, including the following sub-steps:

[0055] Outlier rejection based on adaptive Kalman filtering:

[0056] Initialize the Kalman filter parameters, including the initial values of the state variables, the state transition matrix, the observation matrix, the process noise covariance matrix, and the observation noise covariance matrix, etc. According to the characteristics of the multi-source heterogeneous data of the power grid, set a reasonable initial parameter range to adapt to the fluctuation characteristics of different types of data.

[0057] Construct the Kalman filter denoising state equation:

[0058] x k = Ax k-1 + w k

[0059] z k = Hx k + v k

[0060] where x k is the system state at time step k, A is the system state transition matrix, x k-1 is the system state at time step k-1, w k is the system noise at time step k, z k is the observation value at time step k, H is the observation matrix, x k is the system state at time step k, v k is the observation noise at time step k.

[0061] where the process noise covariance Q = 0.01I represents the uncertainty of the process noise, the observation noise covariance R = 0.1I represents the uncertainty of the observation noise, I is the identity matrix, and when the observation residual is determined to be an outlier, where, is the predicted state vector, S kis the prediction error covariance. Topology-aware data compression: Based on graph theory, construct the device adjacency matrix, and use PCA dimensionality reduction for device groups with a correlation degree > 0.8, retaining the principal components with 95% variance.

[0062] Perform point-by-point filtering on the real-time collected data. At each time step, calculate the Kalman gain based on the current observation value and the predicted value, and then update the state variable estimate and the error covariance matrix. By setting the outlier judgment threshold, when the deviation between the observation value and the estimated value exceeds this threshold, determine that the observation value is an outlier and remove it. For example, for the current waveform data of an intelligent meter, if the current value at a certain moment deviates from the filtered estimated value by more than the set 3σ (σ is the standard deviation) threshold, it is considered that this data point is interfered or abnormal, and it is removed from the subsequent analysis process to reduce the interference of noisy data on subsequent feature extraction and anomaly detection.

[0063] Redundant data compression based on the device topology structure:

[0064] Construct the topology structure diagram of grid devices to clarify the connection relationship and data interaction path between each device. By analyzing the correlation between devices, determine the data redundancy area. For example, in a substation, multiple adjacent intelligent meters may be connected under the same transformer, and the voltage, current and other data collected by them are to a certain extent correlated and redundant.

[0065] According to the topology structure and data correlation, use appropriate data compression algorithms to compress redundant data. For structured data, such as SCADA system state variables, dimensionality reduction algorithms such as principal component analysis (PCA) can be used to extract the main feature components, remove redundant dimensional information, and at the same time retain the main change trend and key information of the data. For semi-structured or unstructured data, such as device log events, rule-based pattern matching and summary generation methods can be used to extract representative log patterns and key event information, compress the lengthy log text data, reduce the data transmission and storage burden, and improve the data processing efficiency of edge computing nodes.

[0066] Real-time collect multi-source heterogeneous data of the power grid through edge computing nodes, including the following sub-steps:

[0067] Collection of intelligent meter current waveform data:

[0068] The edge computing node establishes a communication connection with the intelligent meter, uses an appropriate communication protocol (such as Modbus, DLMS / COSEM, etc.) for data interaction, and establishes MQTT communication between the edge node and the meter to obtain the three-phase current waveform at a sampling rate of 1kHz.

[0069] Periodically obtain current waveform data from the smart meter at set time intervals (e.g., seconds or milliseconds) to ensure the real-time and continuity of the data. These data are sampled at a high frequency and can accurately reflect the dynamic changes of the grid current, providing basic time-domain information for subsequent anomaly detection.

[0070] SCADA system status variable collection:

[0071] Through the communication interfaces of the SCADA system (such as DNP3, 60870.5 and other protocols), the edge computing node obtains the status variable data of grid devices from the servers or workstations of the SCADA system. The OPC UA protocol is used to collect 12-dimensional status parameters such as voltage and power from RTU devices, and the time synchronization accuracy reaches ±10 ms.

[0072] The collected status variables include but are not limited to key parameters such as voltage, current, power, frequency, phase angle, etc. These data reflect the overall operating status of the grid and the working conditions of the devices. The collection period is set according to the grid operation monitoring requirements, usually in seconds or minutes, to ensure that the real-time operation status information of the grid can be obtained in a timely manner.

[0073] Network protocol metadata collection:

[0074] The edge computing node captures and analyzes the data packets in the grid communication network at the network layer to extract network protocol metadata. Based on the NetFlow protocol, the TCP / IP five-tuple is parsed to extract the session duration and the packet size distribution characteristics.

[0075] The collected metadata includes information such as the source IP address, destination IP address, port number, protocol type (such as TCP, UDP, ICMP, etc.), packet length, and transmission timestamp of the data packet. These data can reflect the traffic characteristics and communication behavior patterns of the grid network communication, and are of great significance for detecting abnormal traffic such as network attacks and communication failures. By deploying data packet capture tools (such as tcpdump, Wireshark, etc.) at network nodes or using the mirror port function of network devices, the network traffic data is sent to the edge computing node for processing.

[0076] Device log event collection:

[0077] The edge computing node establishes a log collection channel with various devices in the grid (such as transformers, circuit breakers, relay protection devices, etc.), and uses corresponding log protocols (such as Syslog, SNMP Trap, etc.) to receive the log events generated by the devices. The Syslog protocol is used to collect device anomaly alarms and operation records, and regular expressions are used to extract key event codes.

[0078] The collected device log content includes event information such as the changes in the operating status of the device, fault alarm information, operation records, configuration changes, etc. These log data record the operating history and abnormal situations of the device in text form, and are of great value for analyzing the causes of device failures, detecting abnormal operation behaviors, etc. Log collection is usually event-driven, that is, when a specific event occurs in the device, it actively sends log messages to the edge computing node to ensure that the key event information of the device can be obtained in a timely manner.

[0079] Data spatio-temporal alignment:

[0080] Time alignment: First, determine a unified time reference. Based on the timestamps recorded by devices such as smart meters and SCADA systems, sort all the collected multi-source data by time, and align the data from different sources within the same or similar time intervals to the same time dimension to ensure that the changes of each device and system during the same period can be accurately reflected in subsequent analysis. For example, with a time resolution of second level, align the current waveform data (which may contain millisecond-level timestamps) recorded by the smart meter and the SCADA status variables (updated at the minute level), and process the parts with inconsistent time through interpolation and other methods to make both have corresponding data values at the same time point.

[0081] Space alignment: Based on the geographical topology of the power grid and the physical connection relationship between devices, correlate the data collected from different geographical locations or device nodes in the spatial dimension. For example, for the device data in substations in different regions, according to their positions and hierarchical relationships in the power grid network, perform spatial grouping and correlation, so as to better reflect the overall operation mode and spatial correlation changes of the power grid in subsequent spatio-temporal feature extraction.

[0082] Application of the sliding window mechanism:

[0083] Define the sliding window: Determine the appropriate window size and sliding step length. The window size can be determined according to the requirements of power grid anomaly detection and data characteristics. For example, select 1 minute as the window length, and the sliding step length can be 10 seconds to improve the real-time performance and sensitivity of anomaly detection while ensuring the data coverage range.

[0084] Conversion of unstructured logs: Divide the unstructured device log event data collected by the edge computing node according to the defined sliding window, extract various log events that occur within the window, and convert them into a structured vector form. For example, count the occurrence times, types and other characteristics of various alarm logs, operation logs and other events within the window, and arrange them in sequence to form a sample point in the time series, realizing the conversion from discrete unstructured logs to continuous structured time series, which is convenient for subsequent fusion and analysis with other structured data.

[0085] LSTM Autoencoder Denoising:

[0086] Construct an LSTM autoencoder: Design a suitable LSTM network structure as an autoencoder. The autoencoder consists of an encoder and a decoder. The encoder compresses multi-dimensional time series data (including current after spatio-temporal alignment, state variables, and log features transformed by a sliding window, etc.) into a low-dimensional feature representation space, and the decoder then attempts to reconstruct the original data from the low-dimensional features.

[0087] Noise elimination training: Use the data preprocessed by spatio-temporal alignment to train the LSTM autoencoder. During the training process, aiming to minimize the reconstruction error between the input original data and the output data of the autoencoder, optimize the network parameters through the backpropagation algorithm. Noisy data is difficult to be accurately restored during the reconstruction process. After training is completed, use the trained autoencoder to reconstruct the input data, and use the reconstructed data to replace the original data, thereby eliminating the noise interference introduced by sensors or other acquisition processes, and retaining the meaningful feature parts of the data for subsequent feature extraction and anomaly detection. For example, in the current waveform data of an intelligent electricity meter, due to some random fluctuation noises generated by the sensor being affected by environmental electromagnetic interference, etc., after being processed by the LSTM autoencoder, the contour features of the current waveform are retained, while the noise part is filtered out.

[0088] Frequency domain feature extraction:

[0089] Data preprocessing: Normalize the current waveform data that has been preprocessed by spatio-temporal alignment and denoising, map the data to the interval [0,1], eliminate the amplitude differences between data from different devices and different ranges, and facilitate subsequent feature extraction and comparison.

[0090] Application of improved wavelet packet transform: Decompose the normalized current waveform using an improved wavelet packet transform algorithm. First, according to the characteristics and spectral distribution characteristics of the current signal, determine the optimal decomposition level through an adaptive decomposition level selection algorithm. During the decomposition process, calculate the energy entropy values of each node, and dynamically determine the optimal decomposition scale based on the magnitude of the energy entropy values, so as to be able to more finely capture the energy distribution characteristics of the current signal in different frequency bands. For example, for a certain phase current signal, decompose it into sub-signals in multiple frequency bands through wavelet packet transform, such as the low-frequency band (0 - 50Hz), the middle-frequency band (50 - 100Hz), the high-frequency band (above 100Hz), etc., then calculate the energy of the signal in each frequency band and normalize it to obtain the energy distribution vector of each frequency band, which is used as the frequency domain feature of this phase current.

[0091] Adaptive decomposition level: Select 4-layer decomposition according to the minimum Shannon entropy criterion to obtain 16-band energy distribution:

[0092]

[0093] where E i is the energy of the i-th frequency band, and W i,k is the wavelet packet transform coefficient, representing the value of the signal at the k-th sampling point in the i-th frequency band, and f i is the energy proportion of the i-th frequency band;

[0094] Construct a feature vector F freq = [f1, f2, …, f 16 , which contains the energy proportions of 16 frequency bands.

[0095] Spatio-temporal feature extraction:

[0096] Construct a spatio-temporal graph: According to the topological structure of the power grid and the physical connection relationship between devices, construct a spatio-temporal graph. The nodes in the graph represent various devices in the power grid (such as smart meters, transformers, circuit breakers, etc.), and the edges represent the electrical connection relationship or data interaction relationship between devices. At the same time, introduce the time dimension into the graph structure, and use the sliding window mechanism to take the data of multiple consecutive time points as a spatio-temporal segment. Each spatio-temporal segment corresponds to a spatio-temporal graph, and the node attributes in the graph include the state variables of the devices within the time window (such as voltage, current, power, etc.) and the spectral energy distribution characteristics obtained from the frequency domain feature extraction step, etc.

[0097] Application of spatio-temporal graph convolutional network (ST-GCN): Input the constructed spatio-temporal graph into the spatio-temporal graph convolutional network (ST-GCN) for feature extraction. ST-GCN captures the correlation features between devices in the spatial dimension through graph convolution operations, and at the same time combines the convolutional or recurrent neural network structure in the time dimension to extract the behavior patterns of device groups in the spatio-temporal dimension. For example, for a group of devices in a substation, ST-GCN can learn the spatio-temporal correlation between the voltage and current changes of devices such as transformers, busbars, and outgoing lines at different time points, so as to extract spatio-temporal feature vectors that can reflect the normal operation mode and abnormal change mode of the device group.

[0098] Construct a spatio-temporal graph G = (V, E, T), where V is the set of nodes, representing the devices in the power grid, E is the set of edges, representing the connection relationship between devices, T is the time dimension, and the node attributes include 8-dimensional features such as voltage deviation and harmonic distortion rate.

[0099] Design 3 spatio-temporal convolutional blocks in ST-GCN, and each layer contains:

[0100] Spatial convolution: Approximate the graph Laplacian operator with Chebyshev polynomials, K = 2-order neighborhood

[0101] Temporal convolution: Dilated causal convolution, dilation factor d = 2

[0102] Output a 128-dimensional spatio-temporal feature vector F st 。

[0103] Protocol feature extraction:

[0104] Deep packet parsing: Deeply parse the collected network protocol metadata, with a focus on the data packets of the Modbus / TCP protocol. The parsed content includes fields such as the header information of the packet (e.g., source port, destination port, protocol type, etc.), function code, data field, etc. By parsing the function code, the type of communication operation between devices can be understood, such as reading register data, writing register data, etc.; by parsing the data field, specific communication data content can be obtained, such as the operating parameters of the device, control commands, etc.

[0105] Abnormal function code combination recognition: Based on the results of deep packet parsing, statistically analyze the occurrence frequency, combination order of function codes in the Modbus / TCP session, and their correlation with other protocol fields. By establishing a normal function code combination pattern library, compare the function code combinations in the actual session with the normal pattern library to identify abnormal function code combinations. For example, if a function code combination for writing to the same register appears frequently within a short period of time and the content of the data field does not conform to the normal operation logic of the device, it may indicate abnormal situations such as malicious attacks or device failures. These abnormal function code combinations are used as protocol features for subsequent anomaly detection.

[0106] For the Modbus / TCP protocol, calculate the abnormality degree of function code combinations:

[0107]

[0108] where D normal is the set of historical normal function codes, C i is the count value of the i-th function code, μ i is the historical mean of the i-th function code, σ i is the historical standard deviation of the i-th function code, I(·) is the indicator function, which takes 1 when the condition is true and 0 otherwise, and the threshold is set to S fc > 2.5 triggers an alarm.

[0109] Input the feature vector into a hybrid detection model, which consists of a parallel isolation forest algorithm, an improved CNN-LSTM classifier, and a rule engine based on information entropy. It outputs the anomaly probability using a dynamic weight fusion strategy, including the following sub-steps:

[0110] Isolation forest algorithm detection:

[0111] Feature vector input: The complete feature vector obtained after spatio-temporal alignment preprocessing, noise reduction, and multi-dimensional feature extraction is input into the Isolation Forest algorithm. The Isolation Forest detects abnormal data points by constructing multiple decision trees (isolation trees). When constructing an isolation tree, a random subset of features and a split value are selected to make the path length of the data point in the tree structure as short as possible. Abnormal data points usually have a shorter average path length. 100 iTrees are constructed, with a maximum depth of 15 for each tree and a subsampling amount of 256.

[0112] Anomaly score calculation: For each isolation tree, calculate the path length of the input feature vector in the tree, and then take the average of the path lengths of all isolation trees. According to the relationship between the average path length and the dataset size, map the input feature vector into the anomaly score interval of [0,1]. The closer the anomaly score is to 1, the more likely the sample corresponding to the feature vector is abnormal traffic.

[0113] Improved CNN-LSTM classifier detection:

[0114] CNN layer: 3 one-dimensional convolutional layers, kernel sizes [3,5,7], number of channels [32,64,128];

[0115] LSTM layer: Bidirectional LSTM, 64 hidden units, Dropout = 0.2;

[0116] Output layer: Binary classification probability P activated by Sigmoid clf 。

[0117] Feature vector preprocessing: Appropriately reshape and normalize the input feature vector to meet the input requirements of the CNN-LSTM network. For example, convert the feature vector into a three-dimensional tensor with a fixed time step and feature dimension so that the CNN can extract local features and the LSTM can capture time series features.

[0118] CNN feature extraction: Use the CNN module composed of convolutional layers and pooling layers to extract features from the reshaped feature vector. The convolutional layer slides the convolutional kernel in the time dimension to extract the feature patterns of the feature vector within the local time window, and the pooling layer reduces the dimension and selects features of the extracted features, retains the main feature information, removes redundant information, and enhances the generalization ability of the model.

[0119] LSTM time series modeling: Input the feature sequence extracted by the CNN into the LSTM layer. The LSTM unit models the time series data through the gating mechanism (input gate, forget gate, output gate), and can effectively capture the dependence relationship and dynamic change trend of the feature sequence in the long time range, so as to learn the feature patterns of power grid abnormal traffic in the time dimension.

[0120] Classification output: Add a fully connected layer and an activation function (such as softmax) after the LSTM layer to map the feature vector output by the LSTM to the probability distribution of abnormal categories, and output the probability values corresponding to normal traffic and abnormal traffic for this feature vector.

[0121] Rule engine detection based on information entropy:

[0122] Calculation of feature information entropy: Calculate the information entropy for each feature dimension in the input feature vector. Information entropy is used to measure the uncertainty of features. The larger the entropy value, the higher the uncertainty of the feature, indicating that it may be affected by abnormal factors. For example, for the spectral energy distribution in frequency domain features, calculate the probability distribution of energy values in each frequency band, and then calculate the information entropy of this frequency domain feature according to the information entropy formula.

[0123] Calculation of protocol feature entropy value:

[0124] H(X) = -∑p(x)logp(x)

[0125] Setting dynamic thresholds:

[0126] H th = μH + 2σ H

[0127] Rule matching and anomaly judgment: According to the predefined rule library, match the calculated feature information entropy with the rules in the rule library. The rule library contains the normal and abnormal feature information entropy thresholds or ranges set based on experience or prior knowledge. If the feature information entropy exceeds the normal range, or meets the rule conditions of certain abnormal patterns, it is determined that the sample corresponding to this feature vector is abnormal traffic, and the corresponding abnormal probability value is output (which can be set according to factors such as the confidence level of the rule).

[0128] Application of dynamic weight fusion strategy:

[0129] Real-time calculation of confidence metrics: For the three detectors of the isolation forest algorithm, the improved CNN-LSTM classifier, and the rule engine based on information entropy, calculate their confidence metrics in real time, including the area under the ROC curve (AUC) and the false positive rate (FPR). AUC represents the ability of the detector to distinguish normal and abnormal samples at different thresholds. The larger the AUC, the better the detection performance; FPR represents the proportion of normal samples that are misjudged as abnormal samples. The smaller the FPR, the fewer false alarms of the detector.

[0130] Confidence evaluation, calculation of AUC values for each model:

[0131]

[0132] where w iis the weight of the i-th model, AUC i is the AUC value (area under the curve) of the i-th model, FPR i is the false positive rate of the i-th model;

[0133] Particle swarm optimization:

[0134] Define the fitness function as F1-score, and obtain the optimal weight combination [w if , w clf , w rule after 50 iterations, where w if is the weight of the isolation forest model, w clf is the weight of the CNN-LSTM classifier, w rule is the weight of the information entropy rule engine.

[0135] Construct the fuzzy membership function: According to the calculated confidence indicators (AUC and FPR), construct a fuzzy membership function for each detector. The fuzzy membership function maps the confidence indicators to the fuzzy membership degree interval of [0, 1], indicating the credibility of the detector in the current state. For example, for a detector with a higher AUC and a lower FPR, its fuzzy membership degree is higher, indicating that the detector has a higher reliability in the current detection task.

[0136] Adjust the weights using the particle swarm optimization algorithm: Dynamically adjust the weighting coefficients of each detector using the particle swarm optimization algorithm. Regard the weighting coefficients of each detector as the particle positions in the particle swarm, and use the detection performance of the fused anomaly probability (such as the overall AUC, false alarm rate, etc.) as the optimization objective function. Through the iterative search process of the particle swarm, continuously update the positions and velocities of the particles to find the optimal combination of weighting coefficients, so that the fused anomaly probability has the best detection performance. Finally, weight and fuse the anomaly probabilities output by the three detectors according to the optimized weighting coefficients to obtain the final output result of the anomaly probability.

[0137] When the anomaly probability exceeds the dynamic threshold, trigger a multi-level response mechanism, including the following sub-steps:

[0138] Send traffic shaping instructions to edge devices:

[0139] Instruction generation: Generate targeted traffic shaping instructions according to the characteristics of the abnormal traffic and the resource status of the edge computing node. For example, if it is detected that the current waveform data collected by a certain smart meter shows abnormal high-frequency fluctuations and is judged to be caused by possible malicious attack traffic, the instruction content may include restricting the data upload rate of the meter, adjusting the data sampling frequency, or temporarily blocking some non-critical data collection tasks, etc., to reduce the processing burden and network transmission pressure of the edge device.

[0140] Implement token bucket traffic shaping, rate limit formula:

[0141] R(t) = min(C, B + r·Δt)

[0142] Wherein, R(t) is the available rate at time t, C is the bucket capacity, B is the initial number of tokens in the bucket, r is the token filling rate, Δt is the time interval, C = 10Mbps, B = 5MB, r = 2Mbps.

[0143] Instruction issuance: Through the communication interface (such as fieldbus, wireless communication module, etc.) between the edge computing node and the edge device, the generated traffic shaping instructions are sent to the relevant edge devices in real time. Ensure the reliability and timeliness of instruction transmission, so that the edge devices can quickly respond and adjust their working states, initially control and shape the abnormal traffic, and prevent the abnormal traffic from further spreading or causing greater impact on the power grid operation.

[0144] Cloud platform device fingerprint portrait generation:

[0145] Including the behavior baseline matrix M base ∈R 8×24 and the historical anomaly frequency distribution, M base is the behavior baseline matrix, including 8-dimensional features and a 24-hour time window;

[0146] Data upload: The edge computing node uploads the feature data related to the abnormal traffic (including spatio-temporal features, frequency domain features, protocol features, etc.) and the data after traffic shaping processing to the cloud platform through a secure communication channel. The uploaded data is encrypted and compressed to ensure the security and efficiency of data transmission, and at the same time reduce network bandwidth occupancy.

[0147] Device fingerprint extraction: The cloud platform uses big data analysis and machine learning algorithms to deeply mine and analyze the uploaded data, and extract the fingerprint features of the device. The device fingerprint features include the hardware information of the device (such as device model, manufacturer, hardware parameters, etc.), software information (such as operating system version, application program fingerprint, etc.), running behavior features (such as current waveform pattern and communication behavior pattern during normal operation), and abnormal traffic features (such as the frequency of occurrence of abnormal function code combinations, the time distribution of abnormal traffic, etc.). Through the comprehensive analysis of these features, a multi-dimensional fingerprint portrait of the device is constructed, which can accurately reflect the normal operation state and abnormal behavior pattern of the device.

[0148] Image storage and update: Store the generated device fingerprint images in the database of the cloud platform and establish a dynamic update mechanism. As the operation data of edge devices is continuously uploaded and analyzed, the cloud platform updates the device fingerprint images in real time to ensure that they can timely reflect the latest status and abnormal changes of the devices, providing a more accurate reference basis for subsequent anomaly detection and fault diagnosis.

[0149] Characteristics of blockchain-certified abnormal events:

[0150] Adopt the hash value of the key fields of Hyperledger Fabric for certification, and generate the root hash of the Merkle tree to be uploaded to the blockchain;

[0151] Feature extraction and encapsulation: Extract key abnormal event features from the abnormal traffic detection process, including the time, location, device information, abnormal probability, abnormal feature description (such as abnormal function code combination, abnormal distribution of spectral energy, etc.) of the abnormal occurrence, and relevant data segments, etc. Package these feature information to form a structured abnormal event data packet to prepare for blockchain certification.

[0152] Hierarchical encryption processing: Encrypt the abnormal event data packet using a hierarchical encryption structure. First, perform homomorphic encryption on the original traffic feature data. Homomorphic encryption allows specific computational operations to be performed on encrypted data, and the computational result is consistent with the result of performing the same calculation on the plaintext data after decryption. Through homomorphic encryption, ensure the confidentiality and integrity of the abnormal traffic feature data during blockchain storage and transmission, and at the same time support subsequent necessary data analysis and verification operations. Then, generate a hash digest for the encrypted data packet. The hash digest is used to ensure the integrity and immutability of the data and serves as the unique identifier of the data on the blockchain.

[0153] Consortium blockchain storage and public blockchain synchronization: Store the homomorphically encrypted abnormal event feature data in the consortium blockchain. The consortium blockchain is jointly maintained by a consortium composed of power grid-related enterprises, institutions, etc., and has high security and credibility, which is suitable for storing the core data of power grid abnormal events. At the same time, synchronize the generated hash digest to the public blockchain. The public blockchain has a wide range of distributed nodes and an open ledger feature, which can provide stronger data immutability and traceability. Through the storage of the hash digest on the public blockchain, realize the global certification and verification function of the abnormal event feature data, providing reliable evidence support for subsequent accident investigation, liability determination, etc.

[0154] Experiments show that this method achieves in the IEEE 39-bus test system:

[0155] Abnormal detection rate of 98.7% (a 12.3% improvement compared to a single model)

[0156] False alarm rate of 0.89%

[0157] Response delay < 200ms

[0158] Data compression ratio 62.5%

[0159] A power grid abnormal traffic detection method based on multi-modal data fusion designed according to the present invention solves the problems of data heterogeneity and noise through lightweight cleaning (adaptive Kalman filtering + topology compression) of edge computing nodes and denoising of LSTM autoencoders. A multi-dimensional feature space is constructed by using wavelet packet transform (frequency domain), ST-GCN (spatio-temporal), and deep packet parsing (protocol). The output of the isolated forest, CNN-LSTM, and rule engine is dynamically fused through particle swarm optimization to improve the adaptability of the model. Combining edge traffic shaping, cloud portrait, and blockchain evidence storage forms a closed-loop response. Through multi-modal fusion and edge intelligence collaboration, the bottleneck of traditional detection methods in the complex environment of the power grid is broken through, and new threats such as APT attacks and data injection can be effectively addressed.

[0160] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts among the various embodiments can be referred to each other.

[0161] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A power grid abnormal traffic detection method based on multi-modal data fusion, characterized in that, It includes the following steps: S1. Real-time collect multi-source heterogeneous data of the power grid through edge computing nodes, including current waveforms of smart meters, status variables of the SCADA system, network protocol metadata, and device log events; S2. Perform spatio-temporal alignment preprocessing on the original data, use a sliding window mechanism to convert unstructured logs into time series, and eliminate sensor noise through an LSTM autoencoder; S3. Construct a multi-dimensional feature space, including frequency domain features, spatio-temporal features, and protocol features, to obtain feature vectors; S4. Input the feature vectors into a hybrid detection model, which consists of an isolated forest algorithm in parallel, an improved CNN-LSTM classifier, and a rule engine based on information entropy, and use a dynamic weight fusion strategy to output the anomaly probability; S5. When the anomaly probability exceeds the dynamic threshold, trigger a multi-level response mechanism: send a traffic shaping instruction to the edge device, generate a device fingerprint portrait on the cloud platform, and store the anomaly event features through blockchain; 2. The method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 1, wherein, The specific content of S1 is as follows: The edge computing node establishes a communication connection with the smart meter, uses a communication protocol for data interaction, and periodically obtains current waveform data from the smart meter at a set time interval; The edge computing node obtains the status variable data of power grid devices from the server or workstation of the SCADA system. The collected status variables include voltage, current, power, frequency, and phase angle; The edge computing node captures and analyzes data packets in the power grid communication network at the network layer, extracts network protocol metadata. The collected metadata includes the source IP address, destination IP address, port number, protocol type, data packet length, and transmission timestamp of the data packet. By deploying a data packet capture tool at the network node or using the mirror port function of the network device, the network traffic data is sent to the edge computing node for processing; The edge computing node establishes a log collection channel with various devices in the power grid, uses a log protocol, such as Syslog, SNMPTrap to receive log events generated by the devices. The log collection is event-driven, that is, the device actively sends a log message to the edge computing node when a specific event occurs.

3. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 1, characterized in that, In S1, the edge computing node adopts a lightweight data cleaning strategy, including outlier removal based on adaptive Kalman filtering and redundant data compression based on the device topology structure; The specific content of the outlier removal based on adaptive Kalman filtering is as follows: Initialize the Kalman filter parameters, including the initial value of the state variable, state transition matrix, observation matrix, process noise covariance matrix, and observation noise covariance matrix. Perform point-by-point filtering on the real-time collected data. At each time step, calculate the Kalman gain according to the current observation value and prediction value, update the state variable estimate value and the error covariance matrix, set the outlier judgment threshold, and when the deviation between the observation value and the estimated value exceeds this threshold, determine that the observation value is an outlier and eliminate it.

4. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 3, characterized in that, The specific content of the redundant data compression based on the device topology structure is as follows: Construct a topological structure diagram of power grid equipment, obtain the connection relationships and data interaction paths between various equipment, analyze the correlation between equipment, determine the data redundancy areas, and compress the redundant data using a data compression algorithm according to the topological structure and data correlation. For structured data, use principal component analysis to extract the main characteristic components, remove the redundant dimensional information, and at the same time retain the main change trends and key information of the data. For semi-structured or unstructured data, use rule-based pattern matching and summary generation methods to extract representative log patterns and key event information, and compress the lengthy log text data.

5. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 1, characterized in that, Specifically, S2 is as follows: Set a time reference. Based on the timestamps recorded by smart meters and SCADA systems, perform time sorting on all collected multi-source data, align the data from different sources within the same or similar time intervals to the same time dimension, and associate the data collected from different geographical locations or device nodes in the spatial dimension based on the geographical topological structure of the power grid and the physical connection relationships between equipment. Set the window size and sliding step. Divide the unstructured device log event data collected by edge computing nodes according to the defined sliding window, extract various log events occurring within the window, and convert them into a structured vector form. Design an LSTM network structure as an autoencoder, and use the data preprocessed by spatio-temporal alignment to train the LSTM autoencoder. During the training process, aim to minimize the reconstruction error between the input original data and the output data of the autoencoder, and optimize the network parameters through the backpropagation algorithm. After the training is completed, use the trained autoencoder to reconstruct the input data, and use the reconstructed data to replace the original data to eliminate the noise interference introduced during the sensor or other acquisition processes.

6. The method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 1, wherein, Specifically, S3 is as follows: Extract the spectral energy distribution of each phase current through improved wavelet packet transform to obtain frequency domain features, use a spatio-temporal graph convolutional network to extract the behavior patterns of device groups to obtain spatio-temporal features, and extract abnormal function code combinations of Modbus / TCP sessions based on deep packet parsing to obtain protocol features. Perform normalization processing on the current waveform data after spatio-temporal alignment preprocessing and noise reduction processing, map the data to the interval [0,1]. According to the characteristics and spectral distribution characteristics of the current signal, determine the optimal decomposition layer through an adaptive decomposition layer selection algorithm. During the decomposition process, calculate the energy entropy values of each node, and dynamically determine the optimal decomposition scale based on the magnitudes of the energy entropy values. For a certain phase current signal, decompose it into sub-signals of multiple frequency bands through wavelet packet transform, then calculate the energy of the signal within each frequency band, and perform normalization processing on it to obtain the energy distribution vector of each frequency band, which is used as the frequency domain feature of this phase current. According to the topological structure of the power grid and the physical connection relationship between devices, a spatio-temporal graph is constructed. The nodes in the graph represent various devices in the power grid, representing the electrical connection relationship or data interaction relationship between devices. The time dimension is introduced into the graph structure, and data at multiple consecutive time points are used as a spatio-temporal segment through a sliding window mechanism. Each spatio-temporal segment corresponds to a spatio-temporal graph. The node attributes in the graph include the state variables of the devices within the time window and the spectral energy distribution characteristics obtained from the frequency-domain feature extraction step. The constructed spatio-temporal graph is input into the spatio-temporal graph convolutional network ST-GCN for feature extraction to obtain spatio-temporal features; The collected network protocol metadata is deeply parsed. The parsing content includes the header information, function code, and data field of the message. By parsing the function code, the communication operation type between power grid devices is obtained. By parsing the data field, the specific communication data content is obtained. Based on the results of the deep message parsing, the occurrence frequency, combination order of function codes in the Modbus / TCP session, and the correlation relationship with other protocol fields are statistically analyzed. By establishing a normal function code combination pattern library, the function code combinations in the actual session are compared with the normal pattern library to identify abnormal function code combinations.

7. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 1, characterized in that The specific content of S4 is as follows: The feature vector is input into the hybrid detection model to calculate the confidence index in real time. According to the calculated confidence index, a fuzzy membership function is constructed for each detector. The weighted coefficients of each detector are optimized based on the particle swarm optimization algorithm. The abnormal probabilities output by the three detectors are weighted and fused according to the optimized weighted coefficients to obtain the final abnormal probability output result.

8. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 7, characterized in that, The hybrid detection model includes the isolation forest algorithm detection, the improved CNN-LSTM classifier detection, and the rule engine detection based on information entropy; The specific content of the isolation forest algorithm detection is as follows: Multiple isolation trees are constructed to detect abnormal data points. When constructing the isolation trees, a feature subset and a split value are randomly selected to make the path length of the data points in the tree structure as short as possible. Abnormal data points have a shorter average path length. For each isolation tree, the path length of the input feature vector in the tree is calculated, and then the average value of the path lengths of all isolation trees is taken. According to the relationship between the average path length and the dataset size, the input feature vector is mapped into the abnormal score interval of [0,1]. The closer the abnormal score is to 1, the greater the probability that the sample corresponding to the feature vector is abnormal traffic; The specific content of the improved CNN-LSTM classifier detection is as follows: The CNN module composed of convolutional layers and pooling layers is used to extract features from the reshaped feature vectors. The convolutional layer slides the convolutional kernel in the time dimension to extract the feature patterns of the feature vectors within the local time window. The pooling layer then reduces the dimension and selects features of the extracted features, retaining the main feature information. The feature sequence extracted by the CNN is input into the LSTM layer. The LSTM unit models the time series data through the gating mechanism. A fully connected layer and an activation function are added after the LSTM layer to map the feature vectors output by the LSTM to the abnormal class probability distribution, and output the probability values corresponding to normal traffic and abnormal traffic for the feature vectors.

9. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 8, characterized in that, The rule engine detection based on information entropy is specifically as follows: For the spectral energy distribution in the frequency domain features, calculate the probability distribution of the energy values of each frequency band, and then calculate the information entropy of the frequency domain features according to the information entropy formula. According to the predefined rule library, match the calculated feature information entropy with the rules in the rule library. The rule library contains the normal and abnormal feature information entropy thresholds or ranges set based on experience or prior knowledge. If the feature information entropy exceeds the normal range or meets the rule conditions of the abnormal pattern, it is determined that the sample corresponding to the feature vector is abnormal traffic, and the corresponding abnormal probability value is output.

10. A method for detecting abnormal power grid traffic based on multi-modal data fusion according to claim 7, characterized in that, For the three detectors of the isolation forest algorithm, the improved CNN-LSTM classifier, and the rule engine based on information entropy, calculate their confidence metrics in real time, including the area under the ROC curve AUC and the false positive rate FPR. According to the calculated confidence metrics, construct a fuzzy membership function for each detector. The fuzzy membership function maps the confidence metrics to the fuzzy membership degree interval of [0,1], indicating the credibility of the detector in the current state. For the detector with a high area under the ROC curve AUC and a low false positive rate FPR, its fuzzy membership degree is high, indicating that the detector has high reliability in the current detection task. Use the particle swarm optimization algorithm to dynamically adjust the weighting coefficients of each detector. Regard the weighting coefficients of each detector as the particle positions in the particle swarm, take the detection performance of the fused abnormal probability as the optimization objective function, and through the iterative search process of the particle swarm, continuously update the positions and velocities of the particles to find the optimal combination of weighting coefficients, so that the fused abnormal probability has the best detection performance. Weight and fuse the abnormal probabilities output by the three detectors according to the optimized weighting coefficients to obtain the final abnormal probability output result.

Images