Electric power system intrusion detection and defense method based on artificial intelligence

Abstract

The invention provides a power system intrusion detection and defense method based on artificial intelligence, and belongs to the technical field of power system intelligent control, and the method comprises the steps: 1, collecting data based on a multi-dimensional data collection layer, and forming an original data flow containing a time-space synchronization mark; 2, dynamically segmenting the original data stream by adopting a self-adaptive sliding window mechanism, automatically adjusting the size of a window according to the arrival frequency of a data packet, and converting the continuous data stream into a final triple sequence; 3, extracting and analyzing the features of the final triple sequence, and determining an equipment behavior mode and sequential logic of power operation; 4, performing deviation analysis on the equipment behavior mode and the normal behavior mode, and generating a primary alarm signal when the deviation degree exceeds a dynamic threshold value; and 5, starting multi-stage interlocking verification based on the primary alarm signal to determine an intrusion type, and matching a preset response rule base according to the intrusion type. Intrusion behaviors in the power system are effectively detected and defended in real time.

Description

Technical Field

[0001] The present invention relates to the technical field of power system intelligent control, and in particular to a power system intrusion detection and defense method based on artificial intelligence. Background Art

[0002] As power systems continue to become more intelligent, the digitization and informatization of power equipment are making them more efficient. However, this also exposes numerous security risks, particularly the risk of cyberattacks and intrusions. Existing power system intrusion detection methods, which mostly rely on traditional rules and threshold settings, are unable to effectively address complex and diverse attack behaviors. These methods often suffer from response delays and low accuracy when addressing new intrusions, making them unable to meet the security requirements of intelligent power systems.

[0003] Among existing technical solutions, although many intrusion detection methods can monitor and alarm the system, due to the lack of dynamic adaptive detection mechanisms based on artificial intelligence, they often have deficiencies in the accuracy and timeliness of intrusion identification. In particular, traditional methods perform poorly when the data traffic is large and complex.

[0004] Therefore, the present invention provides an artificial intelligence-based power system intrusion detection and defense method. Summary of the Invention

[0005] This invention provides an artificial intelligence-based power system intrusion detection and prevention method to address the existing issues of slow response and low accuracy in intrusion detection. By leveraging multi-dimensional data collection, an intelligent sliding window mechanism, hierarchical feature extraction, and multi-level interlocking verification, it can effectively detect and prevent intrusions in power systems in real time.

[0006] The present invention provides an artificial intelligence-based power system intrusion detection and defense method, comprising: Step 1: Collect data based on the multi-dimensional data acquisition layer and form an original data stream containing time and space synchronization markers, wherein the multi-dimensional data acquisition layer includes: a physical layer, a network layer, and a control layer; Step 2: Adopt an adaptive sliding window mechanism to dynamically segment the original data stream, automatically adjust the window size according to the frequency of data packet arrival, and convert the continuous data stream into a final triple sequence, where the final triple sequence contains timestamp, source IP, and operation instruction; Step 3: Extract and analyze the features of the final triplet sequence based on multi-layer features to determine the device behavior pattern and the timing logic of the power operation; Step 4: Analyze the deviation between the device behavior pattern and the normal behavior pattern, and generate a primary alarm signal when the deviation exceeds the dynamic threshold; Step 5: Based on the primary alarm signal, start multi-level interlocking verification to determine the intrusion type, and match the preset response rule library according to the intrusion type.

[0007] Preferably, collecting data based on the multi-dimensional data collection layer and forming an original data stream containing spatiotemporal synchronization markers includes: Deploy high-precision sensors at the physical layer to collect circuit breaker status, voltage and current waveforms, and device temperature data in real time and integrate them to obtain device status telemetry data; Capture packets at the network layer to analyze network communication traffic, extract preset protocol fields, and generate protocol parsing data; Monitor the SCADA system at the control layer, record the sending time, target device and parameters of the control instructions, and form a control instruction sequence.

[0008] Mark device status telemetry data, protocol parsing data, and control instruction sequences through preset protocols and attach unified timestamps; Based on the preset power grid topology model, spatial location coding is injected into each piece of equipment status telemetry data, protocol parsing data, and control instruction sequence data; Bind unified timestamps and spatial position codes to device status telemetry data, protocol parsing data, and control instruction sequences, verify timestamp continuity, remove out-of-order data, and generate spatiotemporally synchronized data streams. Perform hash calculation on the spatiotemporal synchronized data stream and output tamper-proof data blocks; Align the device status telemetry data, protocol parsing data, and control instruction sequences in the tamper-proof data block according to time windows to construct a spatiotemporal correlation matrix; Fill missing values ​​caused by communication delays through feature interpolation to generate a complete dataset; The complete data set is stored in a ring buffer, the cache size is dynamically adjusted according to the data volume, and the original data stream with time and space synchronization marks is output.

[0009] Preferably, an adaptive sliding window mechanism is adopted, including: Calculate the data packet arrival interval in real time and generate dynamic frequency; Adjust the sliding window size based on dynamic frequency and output variable-length window sequence; Extract timestamp, source IP and operation instruction from the variable-length window sequence to construct the initial triple sequence; A preceding operation context is appended to each triple in the initial triple sequence to generate an enhanced sequence, and the enhanced sequence is determined as the final triple sequence.

[0010] Preferably, calculating the data packet arrival interval in real time and generating a dynamic frequency includes: Get the time interval between two consecutive data packets: Among them, the arrival time of the i-th data packet is , i=2, 3, ...N, N is the total number of data packets currently collected; Dynamic average time interval based on the time interval between two consecutive data packets: in, is the dynamic averaging time interval, is the weighted average of all time intervals up to the previous moment, and the initial value , starting from the second moment, the weighted average of historical data is gradually incorporated, where is the time-varying smoothing factor: in, is the basic smoothing coefficient, is the sensitivity parameter, is the estimated standard deviation of the time interval at the previous moment, is a very small positive number. is the robustness index, which controls the robustness to deviations; Determine the dynamic frequency based on the dynamic averaging interval and the time-varying smoothing factor: in, is the dynamic frequency.

[0011] Preferably, adjusting the sliding window size based on the dynamic frequency includes: determining a short-term rate of change of the dynamic frequency based on the dynamic frequency; The sliding window size is adjusted based on the dynamic frequency and the short-term rate of change of the dynamic frequency.

[0012] Preferably, the features of the triple sequence of timestamp, source IP, and operation instruction are extracted and analyzed based on a multi-layer feature extraction model to determine the device behavior pattern and the timing logic of the power operation, including: The bottom layer of the multi-layer feature extraction model extracts timestamp features to construct an operation time distribution matrix. The middle layer extracts source IP features to generate a device access relationship graph. The upper layer extracts operation instruction features to form a device state transition logic vector. By integrating T1's time distribution matrix, device access relationship graph, and device state transition logic vector, the pre-trained timing reasoning model is used to output the power operation timing logic, and the device behavior pattern is determined in combination with the device state transition characteristics.

[0013] Preferably, starting a multi-level interlock verification based on the primary alarm signal to determine the intrusion type includes: The source IP associated with the primary alarm signal is matched against the blacklist to generate a suspicious level. Semantic analysis is then performed on the original operation instructions associated with the primary alarm signal to output the attack probability. Generate behavior logs based on associated devices of primary alarm signals; The intrusion type is determined based on the suspicion level, attack probability and behavior date.

[0014] Preferably, the intrusion types include: external attacks, lateral penetration, malicious operations, data tampering, advanced persistent threats, and internal threats.

[0015] Compared with the prior art, the present invention has the following advantages: This solves the problems of slow response and low accuracy in intrusion detection in existing technologies. Through multi-dimensional data collection, intelligent sliding window mechanism, hierarchical feature extraction and multi-level interlocking verification, it can effectively detect and prevent intrusions in the power system in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 It is a flowchart of the power system intrusion detection and defense method based on artificial intelligence. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0019] Example 1: The embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, such as Figure 1 Shown, including: Step 1: Collect data based on the multi-dimensional data acquisition layer and form an original data stream containing time and space synchronization markers, wherein the multi-dimensional data acquisition layer includes: a physical layer, a network layer, and a control layer; Step 2: Adopt an adaptive sliding window mechanism to dynamically segment the original data stream, automatically adjust the window size according to the frequency of data packet arrival, and convert the continuous data stream into a final triple sequence, where the final triple sequence contains timestamp, source IP, and operation instruction; Step 3: Extract and analyze the features of the final triplet sequence based on multi-layer features to determine the device behavior pattern and the timing logic of the power operation; Step 4: Analyze the deviation between the device behavior pattern and the normal behavior pattern, and generate a primary alarm signal when the deviation exceeds the dynamic threshold; Step 5: Based on the primary alarm signal, start multi-level interlocking verification to determine the intrusion type, and match the preset response rule library according to the intrusion type.

[0020] In this embodiment, the deviation analysis between the device behavior pattern and the normal behavior pattern is performed: baseline modeling: the behavior baseline model B1 is trained based on historical normal data; real-time comparison: the similarity score C1 between P1 and B1 is calculated; threshold adjustment: the alarm threshold Y1 is dynamically updated according to the network load; deviation judgment: if C1 exceeds Y1, a primary alarm signal A1 is generated; trigger verification: A1 is passed to the multi-level interlocking verification module.

[0021] In this embodiment, the preset response rule base is matched: rule clustering: hierarchical indexing is performed on the response rule base according to the attack type to generate a rule tree RT1; priority allocation: the response priority P3 is dynamically configured for the rules in RT1; strategy generation: the optimal response strategy Z1 is extracted from RT1 according to I1; simulation execution: the validity of Z1 is verified in a sandbox environment, and the execution report Q1 is output; strategy issuance: if Q1 passes the verification, Z1 is deployed to the target device.

[0022] The above technical solution has the beneficial effect of resolving the existing problems of slow intrusion detection response and low accuracy. Through multi-dimensional data collection, intelligent sliding window mechanism, hierarchical feature extraction and multi-level interlocking verification, it can effectively detect and prevent intrusions in the power system in real time.

[0023] Example 2: The embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, which collects data based on a multi-dimensional data acquisition layer and forms an original data stream containing time and space synchronization markers, including: Deploy high-precision sensors at the physical layer to collect circuit breaker status, voltage and current waveforms, and device temperature data in real time and integrate them to obtain device status telemetry data; Capture packets at the network layer to analyze network communication traffic, extract preset protocol fields, and generate protocol parsing data; Monitor the SCADA system at the control layer, record the sending time, target device and parameters of the control instructions, and form a control instruction sequence.

[0024] Mark device status telemetry data, protocol parsing data, and control instruction sequences through preset protocols and attach unified timestamps; Based on the preset power grid topology model, spatial location coding is injected into each piece of equipment status telemetry data, protocol parsing data, and control instruction sequence data; Bind unified timestamps and spatial position codes to device status telemetry data, protocol parsing data, and control instruction sequences, verify timestamp continuity, remove out-of-order data, and generate spatiotemporally synchronized data streams. Perform hash calculation on the spatiotemporal synchronized data stream and output tamper-proof data blocks; Align the device status telemetry data, protocol parsing data, and control instruction sequences in the tamper-proof data block according to time windows to construct a spatiotemporal correlation matrix; Fill missing values ​​caused by communication delays through feature interpolation to generate a complete dataset; The complete data set is stored in a ring buffer, the cache size is dynamically adjusted according to the data volume, and the original data stream with time and space synchronization marks is output.

[0025] In this embodiment, high-precision sensors are deployed at the physical layer to collect circuit breaker status, voltage and current waveforms, and equipment temperature data in real time and integrate them to obtain equipment status telemetry data: high-precision sensors are deployed on key equipment in the power system (such as circuit breakers, transformers, and busbars) to collect signals such as voltage and current waveforms, opening and closing status, and equipment temperature in real time; an embedded signal processing module (sampling rate ≥ 10kHz) is used to filter out noise and normalize the data format, and integrate it into equipment status telemetry data D1, which contains a triplet of timestamp, device ID, and measurement value.

[0026] In this embodiment, network communication traffic is captured and analyzed at the network layer to extract preset protocol fields: traffic probes are deployed at the network edge based on the DPDK architecture to capture Modbus / TCP, IEC 61850 and other power-specific protocol messages in real time; protocol header fields (such as function codes, register addresses) and payload content are deeply parsed to extract protocol parsing data D2, including source / destination IP, protocol type, operation instructions and session unique identifier. DPDK (Data Plane Development Kit) is an open source high-performance network data packet processing framework developed by Intel. It is mainly used for high-speed network packet processing in Linux / FreeBSD user mode, bypassing the operating system kernel to reduce latency and improve throughput. It is suitable for high-performance network scenarios such as NFV (network function virtualization), SDN, 5G, and cloud computing.

[0027] In this embodiment, the SCADA system is monitored at the control layer, and the sending time, target device and parameters of the control instructions are recorded to form a control instruction sequence: an agent program is deployed on the front-end of the SCADA system to intercept the control instructions (such as circuit breaker opening and voltage regulation) issued by the RTU / PLC, record the sending timestamp, target device number, operation type and parameter value of the instruction, generate a control instruction sequence D3, and mark the instruction priority (urgent / routine).

[0028] In this embodiment, device status telemetry data, protocol parsing data, and control instruction sequences are tagged using a preset protocol. An additional unified timestamp is used to align D1-D3 using the IEEE 1588 (PTP) protocol. The master clock node distributes a unified timestamp T1 (UTC format, accuracy ≤ 1μs). Hardware-level clock synchronization is used to eliminate the impact of network jitter, ensuring the temporal comparability of heterogeneous data.

[0029] In this embodiment, the injection spatial location code is based on the CIM (Common Information Model) power grid topology model, and the device ID is mapped to the hierarchical spatial location code S1 (such as "province-substation-interval-device") and associated with the corresponding metadata field to achieve precise positioning of data in physical space, for example, S1 (such as substation number, device ID).

[0030] In this embodiment, a hash calculation is performed on the spatiotemporal synchronized data stream to output a tamper-proof data block: a unified timestamp and spatial position code are bound to each record of the device status telemetry data, protocol parsing data, and control instruction sequence, the timestamp monotonicity is detected through a sliding window, and out-of-order or duplicate data is discarded; the SHA-256 hash value is calculated for the verified data stream to generate a spatiotemporal synchronized data stream F1 with a digital signature to ensure that the transmission process cannot be tampered with.

[0031] In this embodiment, the device status telemetry data, protocol parsing data, and control instruction sequence in the tamper-proof data block are aligned according to the time window: the spatiotemporal synchronization data stream F1 is segmented with a time window of 10ms, and the device status telemetry data, protocol parsing data, and control instruction sequence are strictly aligned according to T1; association rules are established based on the device ID and protocol session ID, and the spatiotemporal association matrix M1 (dimensions: time × device × protocol × instruction) is constructed, and the placeholders of unmatched items are filled.

[0032] In this embodiment, feature interpolation is used to fill the missing values ​​caused by communication delays to generate a complete data set: for the missing protocol parsing data and control instruction sequence caused by communication delays, the Lagrange interpolation method is used to complete the telemetry data D1, and the missing protocol or instruction fields are predicted based on the BP neural network; M1 is optimized for sparsity to generate a complete data set M2 to meet the continuity requirements of subsequent analysis.

[0033] In this embodiment, the complete data set is stored in a ring buffer, and the cache size is dynamically adjusted according to the data volume: M2 is written to the ring buffer, and the cache size is dynamically adjusted according to the data flow rate (the default capacity is 1GB, and overflow triggers LRU elimination); the original data stream R1 with T1 / S1 markings is output to the feature extraction module, and the buffer snapshot is retained for retrospective analysis.

[0034] The above technical solution has the following beneficial effects: It generates raw data streams through multi-dimensional data collection and spatiotemporal synchronization tagging. This method collects device status, network communication, and control command data, and ensures data integrity and consistency through spatial position encoding and timestamp synchronization. It also generates high-quality spatiotemporal synchronized data streams by hashing tamper-proof data blocks, constructing a spatiotemporal correlation matrix, filling missing values, and dynamically adjusting cache sizes, providing accurate data input for subsequent intrusion detection.

[0035] Example 3: The embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, which adopts an adaptive sliding window mechanism and includes: Calculate the data packet arrival interval in real time and generate dynamic frequency; Adjust the sliding window size based on dynamic frequency and output variable-length window sequence; Extract timestamp, source IP and operation instruction from the variable-length window sequence to construct the initial triple sequence; A preceding operation context is appended to each triple in the initial triple sequence to generate an enhanced sequence, and the enhanced sequence is determined as the final triple sequence.

[0036] In this embodiment, timestamps, source IP addresses, and operation instructions are extracted from variable-length window sequences. Construction of an initial triplet sequence involves extracting core security elements from each variable-length window sequence, including the operation initiation timestamp, communication source IP address (to locate potential attack entry points), and SCADA control instruction content (such as "circuit breaker trip"), to form an initial triplet sequence describing a single operation behavior, the structure of which is <time, source, instruction>.

[0037] In this embodiment, preceding operation context is added to each triple in the initial triple sequence. The enhanced sequence is generated by backtracking through up to N adjacent windows, integrating related instructions from the same source IP (e.g., multiple consecutive parameter modifications), cross-device coordinated operations (e.g., substation A opening followed by substation B closing), and temporal proximity analysis (e.g., operations occurring within a single second). This generates an enhanced sequence S2 containing causal relationships, whose structure is expanded to <time, source, instruction, preceding operation set>. When a high-risk operation combination (e.g., multiple critical equipment restarts within a short period of time) is detected in the enhanced sequence, a window contraction mechanism is triggered to focus on the high-risk period. Conversely, the window is extended for regular operations to reduce computational overhead, ultimately outputting a final triple sequence with contextual annotations.

[0038] The above technical solution has the following beneficial effects: The adaptive sliding window mechanism improves the accuracy and flexibility of power system intrusion detection. By calculating packet arrival intervals in real time and generating a dynamic frequency, the sliding window size is automatically adjusted to form a variable-length window sequence. An initial triple sequence is constructed by combining timestamps, source IP addresses, and operation instructions. The preceding operation context is appended to each triple to generate an enhanced sequence, ultimately resulting in an accurate triple sequence. This method efficiently captures device behavioral characteristics, enhances the system's intrusion detection capabilities, and improves response speed and accuracy.

[0039] Example 4: The embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, which calculates the data packet arrival interval in real time and generates a dynamic frequency, including: Get the time interval between two consecutive data packets: Among them, the arrival time of the i-th data packet is , i=2, 3, ...N, N is the total number of data packets currently collected; Dynamic average time interval based on the time interval between two consecutive data packets: in, is the dynamic averaging time interval, is the weighted average of all time intervals up to the previous moment, and the initial value , starting from the second moment, the weighted average of historical data is gradually incorporated, where is the time-varying smoothing factor: in, is the basic smoothing coefficient, is the sensitivity parameter, is the estimated standard deviation of the time interval at the previous moment, is a very small positive number. is the robustness index, which controls the robustness to deviations; Determine the dynamic frequency based on the dynamic averaging interval and the time-varying smoothing factor: in, is the dynamic frequency.

[0040] In this embodiment, the MS-EWMA algorithm is used to smooth the update interval mean. and standard deviation ; In this embodiment, It is the basic smoothing coefficient, and its value is usually between 0 and 1 (for example, 0.2). It controls the initial size of the smoothing factor. The recommended value is: General scenario: , high-frequency dynamic scenes: , stable and low volatility scenario: ; In this embodiment, the sensitivity parameter adjusts the smoothing factor's "tolerance" to outliers. A larger value represents a more conservative value, meaning only highly abnormal data will be considered to have significant deviations. The value range is: Conservative detection (low false positives): , sensitive detection (early warning): ; In this embodiment, Is a very small positive number used to avoid the denominator being zero and ensure the stability of the formula. It is usually used , for example np.finfo(float).eps( ); In this embodiment, is an estimate of the standard deviation of the time interval at the previous moment: in, is the square of the estimated standard deviation of the previous moment, representing the volatility of historical data, and the smoothing coefficient (Range 0 to 1) controls the weight distribution of historical information and current information. The larger the value, the faster the model responds to new data changes. In this embodiment, is the robustness index, The larger it is, the more drastic the model's response to deviations; the smaller it is, the more robust it is.

[0041] The beneficial effects of the above technical solution are: by constructing an adaptive sliding window mechanism, combining multi-dimensional input (timestamp, source IP, operation instructions, etc.) with dynamic frequency, timely perception of data flow anomalies in the power system is achieved, and the window size is adjusted accordingly, making the system more sensitive to high-frequency threat events while retaining the contextual information of low-frequency behaviors, realizing the intelligent scaling of the analysis window during the power system intrusion detection process.

[0042] Example 5: An embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, which adjusts the sliding window size based on dynamic frequency, including: determining a short-term rate of change of the dynamic frequency based on the dynamic frequency; The sliding window size is adjusted based on the dynamic frequency and the short-term rate of change of the dynamic frequency.

[0043] In this embodiment, determining the short-term rate of change of the dynamic frequency based on the dynamic frequency includes: Determine the short-term rate of change of dynamic frequency (e.g., past Slope of each window): in, is the dynamic frequency of the current window, For the past The historical average dynamic frequency of the window; is the length of each time window; Adjust the sliding window size based on the dynamic frequency and the short-term change rate of the dynamic frequency, including: high-frequency burst flow (DF is high and Trend > 0): reduce the window to the minimum setting value ( ), prioritize real-time threats (such as DoS attack detection). Smooth flow (DF medium and Trend ≈ 0): maintain the current window, balancing real-time and contextual requirements. Low-frequency attenuation flow (DF low and Trend < 0): expand the window to , ensuring complete capture of long-term operations (such as PLC configuration changes); In this embodiment, the window length of the final output matches the characteristics of the data stream, avoiding truncation or redundancy that may be caused by a fixed window.

[0044] The beneficial effect of the above technical solution is that by adjusting the sliding window size based on the dynamic frequency and its short-term rate of change, dynamic data stream processing is achieved for power system intrusion detection. This method can respond to changes in the arrival frequency of data packets in real time and adaptively adjust the sliding window to ensure the accuracy and flexibility of data segmentation. In this way, the system can more efficiently process input data of different frequencies, improving the timeliness and accuracy of intrusion detection, and enhancing the security and defense capabilities of the power system.

[0045] Example 6: The present invention provides an artificial intelligence-based power system intrusion detection and defense method. This method extracts and analyzes the features of a triplet sequence of timestamps, source IP addresses, and operation instructions based on a multi-layer feature extraction model, thereby determining device behavior patterns and the timing logic of power operations. The method includes: The bottom layer of the multi-layer feature extraction model extracts timestamp features to construct an operation time distribution matrix. The middle layer extracts source IP features to generate a device access relationship graph. The upper layer extracts operation instruction features to form a device state transition logic vector. By integrating T1's time distribution matrix, device access relationship graph, and device state transition logic vector, the pre-trained timing reasoning model is used to output the power operation timing logic, and the device behavior pattern is determined in combination with the device state transition characteristics.

[0046] In this embodiment, the bottom layer of the multi-layer feature extraction model extracts the features of the timestamp to construct the operation time distribution matrix, the middle layer extracts the features of the source IP to generate the device access relationship graph, and the upper layer extracts the features of the operation instruction to form the device state transition logic vector: (1) Based on the timestamp field of the triple sequence, statistical analysis and sliding window technology are used to extract the time interval, peak distribution and periodic characteristics of the operation, and construct the operation time distribution matrix T1, which is used to quantify the behavior pattern of the device in the time dimension, and T1 is input to the timing analysis module for correlation calculation. (2) Source IP feature extraction and device access relationship graph generation, the source IP in the triple is topologically modeled, and the access frequency, hop count and permission level between IPs are calculated in combination with the physical connection relationship of the network devices, and the device access relationship graph I1 is generated to describe the interaction pattern between devices, and the spatial correlation features of I1 are passed to the upper-layer behavior analysis module. (3) Operation instruction feature extraction and state transition logic vector formation: Analyze the semantic content of the operation instruction and classify it into predefined operation types (such as "disconnect the circuit breaker" and "adjust the voltage") through natural language processing (NLP) technology. Based on the Markov chain model, the device state transition logic vector C1 is constructed to characterize the temporal dependency of the operation instruction and provide a logical basis for behavior pattern judgment. (4) Multi-feature fusion and temporal reasoning model analysis: Input the time distribution matrix T1, access relationship graph I1 and state transition vector C1 into the pre-trained graph temporal network (GTN) model, jointly analyze the time correlation, spatial topology and instruction logic, output the power operation temporal logic L1, and clarify the compliance operation chain and potential abnormal temporal path. (5) Device behavior pattern judgment and output: Based on the dynamic matching results of the temporal logic L1 and the state transition vector C1, a clustering algorithm is used to divide the device behavior categories (such as normal inspection, fault handling, and malicious operation). Finally, the device behavior pattern P1 and the corresponding risk level label are generated and fed back to the deviation analysis module to trigger the subsequent defense process.

[0047] The beneficial effects of this technical solution include: By extracting and analyzing triple sequences of timestamps, source IP addresses, and operation instructions based on a multi-layered feature extraction model, the accuracy and intelligence of power system intrusion detection are improved. The bottom layer extracts timestamp features to construct an operation time distribution matrix, the middle layer generates a device access relationship graph, and the upper layer forms a device state transition logic vector. After integrating these features, a temporal reasoning model analyzes the sequential logic of power operations and identifies behavioral patterns based on device status, effectively identifying potential intrusions and improving system security and defense capabilities.

[0048] In this embodiment, the time distribution matrix T1, the device access relationship graph, and the device state transition logic vector are integrated to output the power operation timing logic through a pre-trained temporal reasoning model. The device state transition characteristics are then combined to determine the device behavior pattern. The correlation analysis between the time distribution matrix (T1) and the state transition vector (V) verifies whether the operation instruction complies with the timing constraints of the power system (e.g., the event must be reported within 500ms after the protection device is activated). Behavior pattern determination: The device access relationship graph (G) is combined to detect abnormal communication (e.g., unauthorized IP access to control layer devices in the early morning) and compare the behavior deviation with the historical normal pattern library. If the deviation exceeds a dynamic threshold (e.g., adaptively adjusted based on the isolation forest algorithm), it is determined to be an intrusion. Defense response: Based on the intrusion type (e.g., timing violation, topology overreach), the response rule library is matched and corresponding measures (e.g., blocking the IP address, rolling back the instruction) are triggered.

[0049] The beneficial effects of this technical solution include: A multi-layered feature extraction model extracts and analyzes triple sequences of timestamps, source IP addresses, and operation instructions, improving the accuracy and intelligence of power system intrusion detection. The bottom layer extracts timestamp features to construct an operation time distribution matrix, the middle layer generates a device access relationship graph, and the upper layer forms a device state transition logic vector. After integrating these features, a temporal reasoning model analyzes the sequential logic of power operations and identifies behavioral patterns based on device status, effectively identifying potential intrusions and improving system security and defense capabilities.

[0050] Example 7: An embodiment of the present invention provides an artificial intelligence-based power system intrusion detection and defense method, which initiates multi-level interlocking verification based on a primary alarm signal to determine the intrusion type, including: The source IP associated with the primary alarm signal is matched against the blacklist to generate a suspicious level. Semantic analysis is then performed on the original operation instructions associated with the primary alarm signal to output the attack probability. Generate behavior logs based on associated devices of primary alarm signals; The intrusion type is determined based on the suspicion level, attack probability and behavior date.

[0051] In this embodiment, IP blacklist matching and suspicion level assessment: Objective: Perform real-time blacklist comparison on the source IP that triggered the primary alert (A1). Operation: Match known malicious IPs (e.g., threat intelligence databases, historical attack records). Output: Generate a suspicion level (L1) based on the matching results. For example: L1 = High: The IP is on the APT organization's blacklist; L1 = Medium: The IP has previously initiated scanning activities; L1 = Low: The IP appears for the first time but the protocol is abnormal. Enhanced assessment: Combined with characteristics such as the IP's geographic location and access frequency, the credibility is enhanced, providing a preliminary risk weight, which provides a basis for subsequent verification.

[0052] In this embodiment, semantic analysis is performed on the original operation instructions associated with the primary alarm signal. The original operation instructions associated with A1 (such as industrial control protocol Modbus commands and SCADA control instructions) are semantically parsed. Syntax compliance checks are performed to check whether the instructions comply with protocol specifications. Functional risk assessments assess the potential risks of the instructions (for example, "write register" is more sensitive than "read register"). Context consistency checks are performed to check whether the instructions conform to normal equipment operating conditions. Output: The attack probability (P2) is calculated using a pre-trained attack semantic model (such as BERT combined with a rule engine). The value ranges from 0% to 100%. For example, an illegal PLC shutdown instruction may trigger a P2 of 90%.

[0053] In this embodiment, associated devices generate behavior logs based on primary alarm signals. This involves linking associated devices involved in A1 (such as IEDs and HMIs) to replicate the scenario. Operations include: Traffic mirroring: capturing lateral communication packets to detect anomalous sessions; state snapshots: recording key device register values ​​and process lists; and time series analysis: comparing device behavior patterns before and after an operation (e.g., load surges). Output: Generates a structured log (G1) containing a device interaction map, timing anomalies, and permission change records, revealing traces of the attack's lateral movement.

[0054] In this embodiment, the intrusion type is determined by combining the suspicion level, attack probability, and behavior. The intrusion type is ultimately determined based on the fusion of multiple pieces of evidence. The following steps are performed: L1, P2, and G1 are combined and weighted scoring is performed using an evidence fusion algorithm (such as DS evidence theory or weighted voting). For example, I1_score = 0.4*L1+0.3*P2+0.3*G1_Confidence. The rule engine determines: For example, when L1 is High, P2 > 70%, and G1 indicates lateral penetration, it is determined to be an APT attack (I1 = APT). Feedback learning: False positives are added to the training set to optimize the model. Output: Standardized intrusion types (such as DoS, scanning, and data tampering) are output.

[0055] The above technical solution has the following beneficial effects: By initiating multi-level interlocking verification based on primary alarm signals and then activating multi-level interlocking verification based on secondary alarm signals, the accuracy and reliability of power system intrusion detection are improved. A suspicion level is generated by matching the source IP address to a blacklist, and semantic analysis is performed based on the operation instructions to output the attack probability. Furthermore, behavior logs of associated devices are generated, and the intrusion type is accurately determined by combining the suspicion level, attack probability, and behavior logs. This method effectively reduces false positives and missed positives, ensures timely identification and response to potential intrusions, and enhances the security and protection capabilities of the power system.

[0056] Example 8: The embodiments of the present invention provide an artificial intelligence-based power system intrusion detection and defense method. The intrusion types include: external attacks, lateral penetration, malicious operations, data tampering, advanced persistent threats, and internal threats.

[0057] In this embodiment, external attacks (External Attacks): attackers come from the external network or untrusted area and attempt to break through the boundary protection, including: DoS / DDoS attacks: paralyzing the power dispatching system communication through flooding attacks (such as TCP SYN Flood); scanning detection: malicious IP scans the substation port (such as Modbus 502 port) to collect vulnerability information; brute force cracking: password brute force attacks against the SCADA system login interface (such as Web HMI); typical response: triggering IP blacklist blocking, traffic rate limiting or CAPTCHA verification.

[0058] In this embodiment, lateral movement refers to an attacker using compromised devices as a springboard to spread laterally to critical devices (such as PLCs and RTUs). This includes: protocol vulnerability exploitation: tampering with register values ​​through unauthorized instructions in industrial control protocols (such as IEC 60870-5-104); credential theft: obtaining intranet device permissions through pass-the-hash attacks; man-in-the-middle attacks (MITM): hijacking the communication link between the substation and the dispatching center (such as forging GOOSE messages); and typical responses: isolating infected devices, resetting session keys, and enabling network micro-segmentation.

[0059] In this embodiment, malicious operations (Malicious Operations): attackers impersonate legitimate users or devices and send dangerous commands, including: illegal parameter tampering: modifying generator excitation parameters to cause overload (such as modifying the PLC setpoint value); malicious firmware update: uploading PLC firmware containing backdoors (for example, by disguising as a manufacturer patch); logic bomb: implanting timed trigger code (such as shutting off the substation circuit breaker at a specific time); typical responses: rolling back the configuration to a safe version, verifying the operation signature, and enabling the operation approval process; In this embodiment, data tampering (Data Tampering): tampering with monitoring data or logs to cover up the traces of the attack, including: telemetry data forgery: forging voltage / current sensor data (such as sending false PMU data); log erasure: deleting SCADA system logs to evade audits (such as clearing Syslog records); time synchronization attack: disrupting the IEEE 1588 clock synchronization protocol, causing protection malfunction; typical response: enabling data integrity verification (such as blockchain evidence storage) and restoring backup data; In this embodiment, advanced persistent threats (APTs) are long-term, multi-stage attacks (such as state-sponsored power grid infiltration), including: supply chain attacks: implanting backdoors by infecting supplier software (such as protection relay configuration tools); zero-day vulnerability exploits: targeting undisclosed substation equipment vulnerabilities (such as Siemens S7 PLC vulnerabilities); covert communications: using DNS tunnels to leak power grid topology data; typical responses: network-wide threat hunting (Threat Hunting), coordinated national CERT tracing; In this embodiment, insider threats (Insider Threats) are malicious or erroneous operations from authorized personnel (such as operation and maintenance engineers), including: abuse of authority: unauthorized access to sensitive systems (such as unauthorized operation of relay protection devices); misconfiguration: incorrect setting of protection settings leading to cascading failures (such as setting the distance protection range too large); typical response: implementation of the principle of least privilege (PoLP) and a two-person review mechanism for operations.

[0060] The beneficial effect of this technical solution is that it accurately identifies and categorizes multiple types of threats to the power system by refining intrusion types into external attacks, lateral penetration, malicious operations, data tampering, advanced persistent threats, and internal threats. This method improves the intrusion detection system's ability to perceive different attack paths and strategies, facilitates the development of more targeted response measures, and enhances the overall defense depth and security resilience of the system.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. The power system intrusion detection and defense method based on artificial intelligence is characterized by: include: Step 1: Collect data based on the multi-dimensional data collection layer and form an original data stream containing time and space synchronization markers, wherein the multi-dimensional data collection layer includes: physical layer, network layer and control layer; Step 2: Adopt an adaptive sliding window mechanism to dynamically segment the original data stream, automatically adjust the window size according to the frequency of data packet arrival, and convert the continuous data stream into a final triple sequence, where the final triple sequence contains timestamp, source IP, and operation instruction; Step 3: Extract and analyze the features of the final triplet sequence based on multi-layer features to determine the device behavior pattern and the timing logic of the power operation; Step 4: Analyze the deviation between the device behavior pattern and the normal behavior pattern, and generate a primary alarm signal when the deviation exceeds the dynamic threshold; Step 5: Based on the primary alarm signal, start multi-level interlocking verification to determine the intrusion type, and match the preset response rule library according to the intrusion type.

2. The power system intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: The multi-dimensional data acquisition layer collects data and forms a raw data stream containing spatiotemporal synchronization markers, including: Deploy high-precision sensors at the physical layer to collect circuit breaker status, voltage and current waveforms, and device temperature data in real time and integrate them to obtain device status telemetry data; Capture packets at the network layer to analyze network communication traffic, extract preset protocol fields, and generate protocol parsing data; Monitor the SCADA system at the control layer, record the sending time, target device and parameters of the control instructions, and form a control instruction sequence.

3. Use preset protocols to mark device status telemetry data, protocol parsing data, and control instruction sequences, and attach a unified timestamp; Based on the preset power grid topology model, spatial location coding is injected into each piece of equipment status telemetry data, protocol parsing data, and control instruction sequence data; Bind unified timestamps and spatial position codes to device status telemetry data, protocol parsing data, and control instruction sequences, verify timestamp continuity, remove out-of-order data, and generate spatiotemporally synchronized data streams. Perform hash calculation on the spatiotemporal synchronized data stream and output tamper-proof data blocks; Align the device status telemetry data, protocol parsing data, and control instruction sequences in the tamper-proof data block according to time windows to construct a spatiotemporal correlation matrix; Fill missing values ​​caused by communication delays through feature interpolation to generate a complete dataset; The complete data set is stored in a ring buffer, the cache size is dynamically adjusted according to the data volume, and the original data stream with time and space synchronization marks is output.

4. The power system intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: Adopting an adaptive sliding window mechanism, including: Calculate the data packet arrival interval in real time and generate dynamic frequency; Adjust the sliding window size based on dynamic frequency and output variable-length window sequence; Extract timestamp, source IP and operation instruction from the variable-length window sequence to construct the initial triple sequence; A preceding operation context is appended to each triple in the initial triple sequence to generate an enhanced sequence, and the enhanced sequence is determined as the final triple sequence.

5. The power system intrusion detection and defense method based on artificial intelligence according to claim 3 is characterized in that: Calculate packet arrival intervals in real time and generate dynamic frequencies, including: Get the time interval between two consecutive data packets: Among them, the arrival time of the i-th data packet is , i=2, 3, ...N, N is the total number of data packets currently collected; Dynamic average time interval based on the time interval between two consecutive data packets: in, is the dynamic averaging time interval, is the weighted average of all time intervals up to the previous moment, and the initial value , starting from the second moment, the weighted average of historical data is gradually incorporated, where is the time-varying smoothing factor: in, is the basic smoothing coefficient, is the sensitivity parameter, is the estimated standard deviation of the time interval at the previous moment, is a very small positive number. is the robustness index, which controls the robustness to deviations; Determine the dynamic frequency based on the dynamic averaging interval and the time-varying smoothing factor: in, is the dynamic frequency.

6. The power system intrusion detection and defense method based on artificial intelligence according to claim 3 is characterized in that: Adjust the sliding window size based on dynamic frequency, including: determining a short-term rate of change of the dynamic frequency based on the dynamic frequency; The sliding window size is adjusted based on the dynamic frequency and the short-term rate of change of the dynamic frequency.

7. The power system intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: Based on a multi-layer feature extraction model, the system extracts and analyzes the features of the triple sequence of timestamp, source IP, and operation instruction, thereby determining the device behavior pattern and the timing logic of power operation, including: The bottom layer of the multi-layer feature extraction model extracts timestamp features to construct an operation time distribution matrix. The middle layer extracts source IP features to generate a device access relationship graph. The upper layer extracts operation instruction features to form a device state transition logic vector. By integrating T1's time distribution matrix, device access relationship graph, and device state transition logic vector, the pre-trained timing reasoning model is used to output the power operation timing logic, and the device behavior pattern is determined in combination with the device state transition characteristics.

8. The power system intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: Based on the primary alarm signal, multi-level interlock verification is initiated to determine the intrusion type, including: The source IP associated with the primary alarm signal is matched against the blacklist to generate a suspicious level. Semantic analysis is then performed on the original operation instructions associated with the primary alarm signal to output the attack probability. Generate behavior logs based on associated devices of primary alarm signals; The intrusion type is determined based on the suspicion level, attack probability and behavior date.

9. The power system intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: Intrusion types, including: external attacks, lateral penetration, malicious operations, data tampering, advanced persistent threats, and insider threats.

Images