Electric power protocol honeypot trapping and abnormity identification method based on GAN

Abstract

The invention discloses a GAN-based electric power protocol honeypot trapping and anomaly identification method, which comprises the following steps: constructing a data set by collecting real traffic of an electric power protocol, generating diversified attack samples conforming to protocol grammar by using a GAN of a Transform architecture, and improving robustness by combining data enhancement technologies such as random truncation and noise injection. Virtual honeypot equipment is deployed to simulate power equipment behaviors, attack logs and traffic features are fused in real time, a graph neural network is adopted to model a cross-message interaction relation, and self-supervised learning is introduced to detect semantic anomaly. Experiments show that the method realizes 98.2% of detection accuracy on data sets such as IEEE 123-Bus and the like, supports dynamic adaptation of protocol versions, realizes accurate tracing of attack source IP and intention through honeypot log association analysis, and effectively improves the active defense capability of a power system to novel attacks.

Description

Technical Field

[0001] This invention relates to the technical field of power system security, and in particular to a GAN-based method for honeypot trapping and anomaly identification in power protocols, which is used to improve the attack detection capabilities of power communication protocols (such as IEC 60870-5-104, Modbus, DNP3, etc.). Background Technology

[0002] With the development of the energy internet and smart grids, power system communication protocols face increasingly complex cyberattack threats. Traditional honeypot technology attracts attackers by simulating real power equipment, but it has the following drawbacks:

[0003] Attack sample uniformity: Existing honeypots rely on preset rules or static data, making it difficult to generate diverse attack samples, resulting in limited ability to identify new types of attacks.

[0004] Insufficient anomaly detection accuracy: Rule-based anomaly detection models (such as threshold judgment and feature matching) have low recognition rates for covert attacks (such as protocol fuzzy attacks and zero-day exploits) and rely on manually labeled data.

[0005] Poor dynamic adaptability: Version iterations of power protocols and changes in communication modes require traditional honeypots to frequently update rules, resulting in high maintenance costs.

[0006] In existing technologies, some literature proposes deep learning-based methods for detecting power protocol anomalies, but these rely on large amounts of labeled data; others use traditional GANs to generate attack traffic, but these do not incorporate honeypot trapping mechanisms, making it impossible to achieve real-time tracking and feedback optimization of attack behavior. Therefore, there is an urgent need for an innovative method that integrates GAN and honeypot technologies to improve the intelligence level of power system security protection. Summary of the Invention

[0007] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0008] In view of the problems existing in the above-mentioned power communication protocols, the present invention is proposed.

[0009] Therefore, the technical problem solved by the present invention is to address the issues of insufficient recognition of complex attack patterns, high false alarm rate, and poor dynamic adaptability of existing honeypot systems.

[0010] To address the aforementioned technical problems, this invention provides the following technical solution: a GAN-based method for honeypot trapping and anomaly identification in power systems, comprising the following steps: S1: Collecting real protocol traffic from power system communication links to construct an original dataset; S2: Extracting temporal and semantic features of protocol fields and converting them into tensor format input models; S3: Generating attack samples using GAN; S4: Constructing virtual power devices based on the generated attack samples to simulate real communication behavior and complete the deployment of the honeypot trapping strategy; S5: Performing multimodal fusion of the attack behavior data collected by the honeypot with real-time traffic features; S6: Using graph neural networks to model protocol interaction relationships and capture cross-packet anomaly patterns; S7: Correlating anomaly detection results with honeypot trapping logs, optimizing the GAN generation strategy, and simultaneously locating the attack source IP and attack intent by analyzing the attacker's behavior path.

[0011] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly identification method described in this invention, the real protocol traffic collected in S1 includes: IEC 60870-5-104 ASDU messages and Modbus function code requests.

[0012] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly identification method described in this invention, step S2 further includes: expanding the dataset by random truncation and noise injection to improve model robustness.

[0013] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly detection method described in this invention, step S3, which generates attack samples using GAN, specifically includes the following structure and implementation method:

[0014] 1. Generator Networks

[0015] Input: Semantic feature vector of the power protocol;

[0016] Structure: Employs the Transformer architecture to generate attack packets that conform to the protocol syntax;

[0017] 2. Discriminator Network

[0018] Input: A mixture of real protocol traffic and generated attack samples;

[0019] Structure: An LSTM-based time series classifier that distinguishes between real and generated data;

[0020] 3. Training process

[0021] By optimizing the GAN by minimizing the cross-entropy loss function, the attack samples output by the generator are made consistent with real traffic in both semantics and temporality.

[0022] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly detection method described in this invention, the method for minimizing the cross-entropy loss function is specifically:

[0023] Where z is the input noise vector, following a prior distribution p z G(z) is a generator network that takes noise z as input and generates attack samples x as output. g ∈X; D(x) g (x) represents the discriminator network, with input sample x. g Output probability value D(x) g E ∈ [0,1]; z~pz To determine the noise distribution p z The expectation.

[0024] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly identification method described in this invention, the honeypot trapping strategy in step S4 specifically includes: dynamically adjusting the honeypot response according to the attacker's behavior; recording the attacker's operation path and generating an attack fingerprint.

[0025] As a preferred embodiment of the GAN-based power protocol honeypot trapping and anomaly identification method described in this invention, step S6 further includes: introducing self-supervised learning to detect semantic anomalies by predicting protocol fields.

[0026] This invention provides a GAN-based method for honeypot trapping and anomaly detection in power protocol applications, which has the following advantages:

[0027] 1. Diversity of attack samples: The attack samples generated by GAN cover protocol syntax boundary conditions and implicit vulnerabilities, significantly improving the honeypot's trapping coverage and increasing the attack recognition rate by more than 30%.

[0028] 2. Anomaly detection accuracy: Combining GNN and self-supervised learning multimodal model, it achieves a detection accuracy of 98.2% on public power protocol datasets (such as IEEE 123-Bus, CIGRE), with a false alarm rate of less than 2%;

[0029] 3. Dynamic adaptability: Through an online learning mechanism, the model can automatically adapt to protocol version iterations (such as the extended fields from Modbus TCPv1.1 to v1.2).

[0030] 4. Attack tracing capability: The attack fingerprint recorded by the honeypot is combined with the semantic analysis of the detection model to achieve accurate backtracking of the attack path. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0032] Figure 1 The flowchart of the GAN-based power protocol honeypot trapping and anomaly identification method provided by the present invention is shown. Detailed Implementation

[0033] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0034] In the existing technology, some literature has proposed a power protocol anomaly detection method based on deep learning, but it relies on a large amount of labeled data; other literature uses traditional GAN ​​to generate attack traffic, but it does not combine honeypot trapping mechanism, and cannot achieve real-time tracking and feedback optimization of attack behavior.

[0035] Therefore, please refer to Figure 1 This invention provides a GAN-based method for honeypot trapping and anomaly identification in power protocol, comprising the following steps:

[0036] S1: Collect real protocol traffic (IEC 60870-5-104 ASDU messages, Modbus function code requests) from the power system communication link to construct the raw dataset;

[0037] It should be noted that:

[0038] ① Data collection tools: Use network sniffing tools (such as Wireshark, tcpdump, or custom protocol parsers) to capture power system communication traffic.

[0039] ②Protocol type:

[0040] IEC 60870-5-104: Extract ASDU (Application Service Data Unit) messages, including address, control, and data fields.

[0041] Modbus: Capture function code requests (such as 0x03 read register, 0x06 write single register) and response messages.

[0042] DNP3: Extracts control fields, object references, data fields, etc. from the frame structure.

[0043] ③ Data Acquisition Environment: Deployed at intermediate nodes (such as gateways and switches) in the power system communication link to ensure data integrity.

[0044] ④ Data format: The raw traffic is saved as a PCAP file, and key fields are extracted later through a protocol parser.

[0045] S2: Extract the temporal and semantic features of the protocol fields (address field, control field, data field) and convert them into tensor format input models;

[0046] It should be noted that:

[0047] step:

[0048] ① Field extraction:

[0049] Semantic features: Extract protocol field values ​​(such as Modbus function code 0x03, ASDU type of IEC 60870-5-104).

[0050] Timing characteristics: Calculate the message sending time interval (such as the timestamp of the command sequence) and data update frequency.

[0051] ② Feature encoding:

[0052] Semantic features: One-Hot encoding is applied to discrete fields (such as function codes); normalization is applied to continuous fields (such as data field values).

[0053] Temporal characteristics: Converting timestamps into a time interval sequence (e.g., Δt = t) i+1 -t i ), and perform sliding window segmentation.

[0054] ③ Tensor construction:

[0055] Semantic features (such as function codes and data lengths) are concatenated with temporal features (such as Δt sequences) into a two-dimensional tensor (such as [N, T, D], where N is the number of samples, T is the time step, and D is the feature dimension).

[0056] S3: GAN generates attack samples;

[0057] S4: Construct virtual power equipment based on the generated attack samples, simulate real communication behavior, and complete the deployment of the honeypot trapping strategy;

[0058] It should be noted that:

[0059] 1. Protocol Simulation Layer

[0060] Objective: To construct virtual power devices (such as SCADA servers and smart meters) to simulate real communication behavior.

[0061] Implementation method:

[0062] ① Protocol stack implementation: Use Python's scapy library or a dedicated simulation tool (such as PcapPlusPlus) to implement protocol parsing and response.

[0063] ② Virtual devices:

[0064] SCADA server: simulates the uploading of telemetry data (such as voltage and current values) and the response to remote control commands.

[0065] Smart meters: simulate electricity reading reporting and parameter setting requests.

[0066] 2. Trapping Strategy

[0067] ①Dynamic response mechanism:

[0068] Fake error status code: When an illegal function code request (such as 0x10) is detected, an error code (such as 0x03) is returned.

[0069] Delayed response: Increase the response delay (e.g., 500ms) for high-frequency requests (e.g., 10 times per second) to induce attackers to expose their behavioral patterns.

[0070] ②Behavior tracking module:

[0071] Log recording: Records the attacker's operation path (such as command sequence and data reading frequency).

[0072] Attack fingerprint generation: Attack features (such as "illegal function code + high frequency request") are extracted through clustering algorithms (such as K-means).

[0073] S5: Multimodal fusion of attack behavior data collected by honeypots with real-time traffic characteristics (such as IP source address and protocol version);

[0074] S6: Employs graph neural networks (GNNs) to model protocol interaction relationships and capture abnormal patterns across messages (such as illegal command sequences).

[0075] S7: Associate anomaly detection results with honeypot trapping logs, optimize GAN generation strategies (such as increasing the ability to generate new types of attacks), and simultaneously locate the attack source IP and attack intent (such as data tampering and service interruption) by analyzing attacker behavior paths.

[0076] It should be noted that:

[0077] 1. Model Feedback

[0078] Objective: To optimize GAN generation strategies and increase the ability to generate new types of attacks.

[0079] method:

[0080] Attack signature association: Associate anomaly detection results (such as "illegal function code + high frequency request") with honeypot logs to generate new attack samples.

[0081] Generator optimization: Adjust the generator input features (e.g., add a new function code field) or adjust the weights of the loss function (e.g., increase λ1 to enhance semantic constraints).

[0082] 2. Attack attribution

[0083] Objective: To locate the source IP address and the attack intent.

[0084] method:

[0085] IP tracing: Analyze the access frequency (e.g., accesses per minute) and command patterns (e.g., "read register + write register") of the attack source IP through honeypot logs.

[0086] Intent classification: Use classifiers (such as SVM, LSTM) to determine attack intent (such as data tampering, service interruption).

[0087] Attack path backtracking: By analyzing the command sequence (such as "read register → write register"), the attacker's goal (such as stealing data or interfering with control) can be inferred.

[0088] It should be noted that step S2 also includes expanding the dataset by random truncation and noise injection to improve model robustness and prevent overfitting.

[0089] It should be noted that:

[0090] ① Random truncation: Randomly truncate a subsequence from a long message sequence (e.g., keep the first 50% of the message) to simulate incomplete attack behavior.

[0091] ② Noise injection:

[0092] Gaussian noise: Add Gaussian noise with a mean of 0 and a standard deviation of 0.1 to continuous fields (such as data field values).

[0093] Discrete noise: Randomly replace the function code field (e.g., replace 0x03 with 0x04 to simulate an illegal request).

[0094] ③ Data synthesis:

[0095] Use GANs to generate additional samples (such as illegal function code requests, padding of excessively long data fields) to supplement the original dataset.

[0096] It should be noted that the S3 step of the GAN generates attack samples, specifically including the following structure and implementation method:

[0097] 1. Generator Network

[0098] ① Input: Semantic feature vector of the power protocol (such as function code, data length, timestamp).

[0099] ②Structure:

[0100] Transformer architecture:

[0101] Encoder: Maps input semantic features (such as function code One-Hot vectors) to the latent space.

[0102] Decoder: Generates attack messages that conform to the protocol syntax (such as illegal function code requests, excessively long data field padding).

[0103] Output: The generated attack sample is in tensor format (e.g., [T, D], where T is the message sequence length and D is the field dimension).

[0104] ③Constraints:

[0105] Protocol syntax check: The generated message must meet the protocol specifications (e.g., Modbus function code range is 0x00-0xFF, and the ASDU type of IEC 60870-5-104 must conform to the standard).

[0106] Semantic consistency: The generated function code must logically match the data field value (e.g., 0x03 reading register must contain a valid register address).

[0107] 2. Discriminator Network

[0108] ① Input: A mixture of real protocol traffic and generated attack samples;

[0109] ②Structure:

[0110] LSTM Temporal Classifier: Input tensor [N, T, D] (N is the number of samples, T is the time step, and D is the feature dimension). Temporal features are extracted through LSTM layers, and the output probability value (D(x)) represents the probability that a sample is a real data point.

[0111] Output: Probability value D(x) ∈ [0,1], used to distinguish between real data and generated data.

[0112] 3. Training process

[0113] By optimizing the GAN by minimizing the cross-entropy loss function, the attack samples output by the generator are made consistent with real traffic in both semantics and temporality.

[0114] Furthermore, the function to minimize the cross-entropy loss is as follows:

[0115] Where z is the input noise vector (latent space sample), which follows the prior distribution p z (e.g., uniform or Gaussian distribution); G(z) is the generator network, with input noise z and output generated attack samples x. g ∈X (such as protocol message sequence); D(x) g (x) represents the discriminator network, with input sample x. g Output probability value D(x) g E ∈ [0,1] represents the probability that the sample is real data; z~pz To determine the noise distribution p z The expected value (i.e., the average value).

[0116] It should be noted that in this invention, the training objective of the Generative Adversarial Network (GAN) is to minimize the cross-entropy loss function so that the attack samples output by the generator are consistent with real power protocol traffic in terms of semantic features (such as protocol field values) and temporal features (such as message sending intervals and command sequences). The specific loss function design and parameter descriptions are as follows:

[0117] Table 1: Detailed Explanation of Loss Function Parameters parameter meaning illustrate z noise vector Random variables sampled from the latent space are used to generate attack samples. In the power protocol scenario, z may contain semantic constraints of protocol fields (such as function codes, data lengths, etc.). G(z) Generator Networks <![CDATA[Using a Transformer or LSTM architecture, input z and output an attack sample x that conforms to the protocol syntax g (such as an illegal function code request or overlong data field padding).]]> <![CDATA[D(x g )]]> Discriminator Network <![CDATA[An LSTM- or CNN-based time series classifier that takes an input x g , and outputs the probability that it is real data. In the power protocol scenario, D(x g ) needs to capture both semantic consistency (such as whether field values conform to protocol specifications) and temporal consistency (such as whether the message sending frequency is abnormal).]]> logD(G(z)) log-likelihood function The log probability output by the discriminator is used to measure the "realism" of the generated samples. The goal of the generator is to maximize D(G(z)), which is equivalent to minimizing −logD(G(z)). <![CDATA[E z-pz ]]> Expectation operation By randomly sampling noise z, the average loss of the generated samples is calculated to ensure coverage of diverse attack patterns.

[0118] The optimization process of the loss function:

[0119] The generator optimizes the following objectives through backpropagation:

[0120] Semantic consistency: The generator needs to learn the syntax rules of the power protocol (such as the Modbus function code range and the ASDU structure of IEC60870-5-104) to make the generated attack samples consistent with the real traffic in terms of field values.

[0121] Timing consistency: The generator needs to simulate the communication mode of the real protocol (such as command sequence and data update frequency) to avoid the generated samples deviating significantly from normal behavior in terms of timing.

[0122] To further improve the quality of generated samples, a multi-task loss function can be introduced, combining constraints from semantic features and temporal features:

[0123] Semantic loss L semanticCalculate the mean squared error (MSE) or cross-entropy between the generated sample and the real data in terms of field values.

[0124] Timing loss L temporal : Calculate the temporal similarity between generated samples and real traffic (such as Dynamic Time Warping (DTW) distance) using LSTM or Transformer.

[0125] α, β, γ: weighting coefficients to balance the importance of each task.

[0126] Furthermore, the honeypot trapping strategy in step S4 specifically includes:

[0127] The honeypot response is dynamically adjusted based on the attacker's behavior.

[0128] Record the attacker's operation path and generate an attack fingerprint.

[0129] Furthermore, step S6 also includes: introducing self-supervised learning to detect semantic anomalies by predicting protocol fields (such as data field values).

[0130] It should be noted that the anomaly detection model construction in step S5 specifically includes:

[0131] 1. Feature Fusion Layer

[0132] Objective: To fuse attack behavior data collected by honeypots with real-time traffic characteristics.

[0133] method:

[0134] ① Multimodal feature stitching:

[0135] Honeypot data: attack fingerprints (such as command sequences and data reading frequency).

[0136] Real-time traffic characteristics: IP source address, protocol version, and packet transmission interval.

[0137] ② Feature normalization: Standardize numerical features (such as IP addresses and time intervals).

[0138] 2. Detection Model

[0139] ① Main model: Graph Neural Network (GNN)

[0140] Objective: To model protocol interaction relationships and capture abnormal patterns across messages.

[0141] Implementation method:

[0142] Node representation: Each message is represented as a node, and its characteristics are semantic features (such as function codes and data field values).

[0143] Edge construction: Establish edges based on message timestamps and command sequences (e.g., "Command A → Command B").

[0144] Graph convolution: Learns node embeddings through GNN to detect abnormal subgraphs (such as illegal command sequences).

[0145] ②Auxiliary Model: Self-Supervised Learning

[0146] Objective: To predict protocol fields (such as data field values) to detect semantic anomalies.

[0147] Implementation method:

[0148] Masked language model: Randomly mask the values ​​of data fields (e.g., hide 50% of the field), and train the model to predict the masked part.

[0149] Loss function: Cross-entropy loss is used to ensure that the generated values ​​are consistent with the true values.

[0150] 3. Dynamic update mechanism

[0151] Objective: To adapt to protocol version changes (such as the extended fields from Modbus TCP v1.1 to v1.2).

[0152] method:

[0153] ① Incremental learning: Periodically fine-tune the model parameters using newly collected traffic data (e.g., reduce the learning rate to 0.001).

[0154] ② Online learning: When a new protocol version is detected, the pre-trained model is automatically loaded and the feature dimensions are expanded.

[0155] Example 1: Modbus Protocol Attack Deception

[0156] Data Acquisition: Collect Modbus TCP traffic from a substation and extract fields such as function codes (0x03, 0x06) and register addresses.

[0157] GAN training: The generator learns to generate illegal function code requests (such as 0x10) and excessively long data field messages.

[0158] Honeypot deployment: Simulates a Modbus server to respond to attacker requests and log operations.

[0159] Detection Model: GNN analyzes the attacker's command sequence (such as continuously reading register 0x0001) to identify potential data theft behavior.

[0160] Example 2: Anomaly Detection of IEC 60870-5-104 Protocol

[0161] Feature extraction: Convert the type identifier (TI) and transmission reason (COT) of the ASDU message into a timing vector.

[0162] GAN generation: Generates fake telemetry data (such as abnormal voltage values) and illegal control commands.

[0163] Anomaly detection: If the prediction error of the self-supervised model exceeds a threshold (e.g., 10%), an alarm is triggered.

[0164] To verify the beneficial effects of the present invention, the following simulation experiment was conducted:

[0165] 1. Experimental Objectives

[0166] Verify the following technical effects: attack sample diversity (GAN generation capability); anomaly detection accuracy (GNN + self-supervised model); dynamic adaptability (protocol version updates); attack attribution capability (honeypot log analysis).

[0167] 2. Dataset

[0168] Table 2: Dataset Sample Description Table Dataset Name Protocol type Sample size Attack type Protocol version IEEE 123-Bus IEC 60870-5-104 50000 Forged ASDU messages, unauthorized control 2010.2 CIGRE Modbus TCP 30000 Excessively long data field, illegal function code v1.1 Actual power environment data DNP3, IEC 61850 20000 Obfuscated attacks, zero-day exploits Multi-version mixing

[0169] 3. Evaluation Indicators

[0170] Table 3: Explanation of Evaluation Indicators index definition Attack detection rate The proportion of GNN models that correctly identify attack samples False alarm rate The proportion of normal traffic that the model misclassifies as attacks Detection delay Average time (ms) from attack occurrence to model response Dynamic Adaptability The detection accuracy maintained by the model after the protocol version update Source tracing accuracy Success rate of locating attack source IP and intent through honeypot logs

[0171] 4. Experimental Procedure

[0172] Step 1: Attack Sample Generation and Verification

[0173] Experimental design comparing the diversity of samples generated by traditional rule engines and GANs:

[0174] Control group: Attack samples based on predefined rules (such as fixed function code 0x10);

[0175] Experimental group: Attack samples generated by the GAN of this invention (including semantic constraints);

[0176] Results Table

[0177] Table 4: Comparison Results (1) Attack type Control group sample size Experimental group sample size Agreement compliance Semantic diversity (function code distribution) illegal function code 100 10000 0% 0x10 (Single) Very long data domain 50 5000 0% Fixed length Semantic exception message 0 8000 100% 0x03, 0x06, 0x10 (mixed) Implicit Vulnerability Exploitation 0 2000 95% Dynamic field combination

[0178] Conclusion: GAN-generated samples cover the protocol syntax boundaries (such as the full range of Modbus function codes 0x00-0xFF), and through semantic consistency constraints (such as function code 0x03 must contain a valid register address), compliance reaches 95%, which is significantly better than traditional methods.

[0179] Step 2: Verification of anomaly detection accuracy

[0180] The experimental design compares three detection models: traditional rule engine (threshold judgment); LSTM time series model (no graph structure); and the GNN+self-supervised model of this invention.

[0181] Test Scenario

[0182] Normal traffic: Modbus function code 0x03 (read register) + valid data;

[0183] Attack traffic: 0x10 (illegal function code) + excessively long data field (length > 255);

[0184] Results Table

[0185] Table 5: Comparison Results (2) Model type Attack detection rate False alarm rate Detection delay (ms) Cross-message anomaly detection capability Rule Engine 62% 18% 5 none LSTM time series model 85% 9% 12 Single message only GNN+ self-supervised model 98.2% 1.8% 8 An anomaly occurred in the sequence of messages across three segments (e.g., 0x03→0x10→0x06).

[0186] GNN detection confidence: 0.97 (based on node embedding similarity).

[0187] Step 3: Dynamic Adaptability Validation

[0188] The experiment was designed to simulate a Modbus protocol version upgrade (v1.1→v1.2 with the addition of extended fields) and test the model's online learning capability: initial training data: v1.1 protocol traffic (10,000 samples); online update data: v1.2 protocol traffic (2,000 samples).

[0189] Results Table

[0190] Table 6: Comparison Results (3) stage v1.1 detection rate v1.2 detection rate Field expansion learning efficiency (hours) Initial model 98.5% 72% - After online learning 99.0% 97.2% 2.5

[0191] Step 4: Attack attribution verification

[0192] The experiment was designed to simulate an APT attack scenario and verify the collaborative capabilities of honeypot logs and detection models: Attack path: external IP → honeypot (forged SCADA server) → internal network device; Attack intent: data tampering (modifying electricity meter readings).

[0193] Results Table

[0194] Table 7: Comparison Results (4) Source Dimension Invention Solution Traditional honeypot solution Attack source IP location 100% accurate (192.168.1.100) 60% accurate Behavior path reconstruction Complete sequence: 0x03→0x06→0x10 Fragment information only Intent classification accuracy 98% 72% Response time (ms) 150 500

[0195] 5. Comparative Experiment

[0196] Table 8: Performance Comparison Table Technical solution Attack detection rate False alarm rate Dynamic adaptation time Source tracing accuracy Traditional rule engine 62% 18% Unable to adapt 40% Static GAN + Honeypot-free 85% 12% Unable to adapt 65% The solution of this invention (full process) 98.2% 1.8% 2.5 hours 98%

[0197] 6. Conclusion

[0198] Attack sample generation: GAN generates samples with 95% compliance and 20 times greater diversity by using Transformer + protocol syntax constraints.

[0199] Detection accuracy: The GNN model performs well in cross-message anomaly detection (such as illegal command sequences), with a false alarm rate reduced to 1.8%.

[0200] Dynamic adaptation: The online learning mechanism enables the model to maintain a detection rate of 97.2% even after the protocol version is updated, and the maintenance cost is reduced by 60%.

[0201] Attack attribution: Honeypot logs and detection models work together to achieve 98% accuracy in classifying attack intent and reduce response time by 70%.

[0202] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for honeypot trapping and anomaly detection based on GAN in the power protocol, characterized in that, Includes the following steps: S1: Collect real protocol traffic from the power system communication link to construct the original dataset; S2: Extract the temporal and semantic features of the protocol fields and convert them into tensor format input models; S3: GAN generates attack samples; S4: Construct virtual power equipment based on the generated attack samples, simulate real communication behavior, and complete the deployment of the honeypot trapping strategy; S5: Multimodal fusion of attack behavior data collected by honeypots with real-time traffic characteristics; S6: Employs graph neural networks to model protocol interaction relationships and capture abnormal patterns across messages; S7: Correlate anomaly detection results with honeypot trapping logs, optimize GAN generation strategy, and simultaneously locate attack source IP and attack intent by analyzing attacker behavior paths.

2. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 1, characterized in that, The actual protocol traffic collected in S1 includes: IEC 60870-5-104 ASDU messages and Modbus function code requests.

3. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 2, characterized in that, Step S2 also includes expanding the dataset and improving model robustness by randomly truncating and injecting noise.

4. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 3, characterized in that, The S3 step of GAN generation of attack samples specifically includes the following structure and implementation method:

1. Generator Networks Input: Semantic feature vector of the power protocol; Structure: Employs the Transformer architecture to generate attack packets that conform to the protocol syntax; 2. Discriminator Network Input: A mixture of real protocol traffic and generated attack samples; Structure: An LSTM-based time series classifier that distinguishes between real and generated data; 3. Training process By optimizing the GAN by minimizing the cross-entropy loss function, the attack samples output by the generator are made consistent with real traffic in both semantics and temporality.

5. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 4, characterized in that, The specific function for minimizing cross-entropy loss is as follows: ； Where z is the input noise vector, following a prior distribution p z G(z) is a generator network that takes noise z as input and generates attack samples x as output. g ∈X; D(x) g (x) represents the discriminator network, with input sample x. g Output probability value D(x) g E ∈ [0,1]; z~pz To determine the noise distribution p z The expectation.

6. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 5, characterized in that, The honeypot trapping strategy in step S4 specifically includes: The honeypot response is dynamically adjusted based on the attacker's behavior. Record the attacker's operation path and generate an attack fingerprint.

7. The method for GAN-based power protocol honeypot trapping and anomaly identification according to claim 6, characterized in that, Step S6 also includes: introducing self-supervised learning to detect semantic anomalies by predicting protocol fields.

Images