Method and system for constructing power intelligent device network traffic feature information library

Abstract

The embodiment of the application provides a kind of power intelligent device network flow feature information library construction method and system, belong to electric digital signal processing technical field.The construction method includes: obtaining the network stream information to be processed;According to the network stream information, construct space-time diagram;The similarity of each node in space-time diagram is calculated using dynamic time warping method, to determine the weight of the edge between each two nodes;Space-time dependent feature vector in the space-time diagram is extracted using space-time attention network;The space-time dependent feature vector is trained and learned using federated self-supervised feature learning method, to obtain corresponding robust feature vector;Dynamic feature selector determines feature subset according to the robust feature vector;Based on the feature subset, construct feature information library.The construction method and system can construct power equipment network flow feature information library suitable for diversified network flow.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric digital signal processing, in particular to a method and system for constructing a network flow feature information base of power intelligent devices. BACKGROUND

[0002] With the large-scale access of power Internet of Things devices, network flow presents high dimensionality, encryption and multi-source heterogeneity. Network flow contains rich information, including normal flow and various types of abnormal flow, such as malicious attack flow, botnet flow, etc. Accurate identification and analysis of network flow is of great significance for network security protection, rational allocation of network resources, and network service quality assurance. However, traditional network flow identification methods have many limitations, such as insufficient feature modeling, data island problem, static feature redundancy, etc., which are difficult to meet the current network environment requirements. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a method and system for constructing a network flow feature information base of power intelligent devices, which can construct a network flow feature information base of power devices suitable for diversified network flow.

[0004] In order to achieve the above-mentioned purpose, the embodiments of the present application provide a method for constructing a network flow feature information base of power intelligent devices, comprising:

[0005] obtaining network flow information to be processed;

[0006] constructing a space-time graph according to the network flow information;

[0007] calculating the similarity of each node in the space-time graph by using a dynamic time warping method to determine the weight of the edge between each two nodes;

[0008] extracting a space-time dependent feature vector in the space-time graph by using a space-time attention network;

[0009] training and learning the space-time dependent feature vector by using a federated self-supervised feature learning method to obtain a corresponding robust feature vector;

[0010] determining a feature subset according to the robust feature vector by using a dynamic feature selector;

[0011] constructing a feature information base based on the feature subset.

[0012] Optionally, the space-time graph is constructed according to the network flow information, comprising:

[0013] The spatiotemporal graph is constructed by taking individual data packets in the network flow information as nodes and the relationships between data packets as edges. The relationships include time features representing time intervals and arrow directions representing transmission directions.

[0014] Optionally, a dynamic time warping method is used to calculate the similarity of each node in the spatiotemporal graph to determine the weight of the edge between any two nodes, including:

[0015] The weight of the edge between any two nodes is determined using formula (1):

[0016] (1)

[0017] in, For the first The node and the first The weights of the edges between nodes. For smoothing coefficients, It is a dynamic time warping function. This is a weight adjustment function determined based on the protocol type.

[0018] Optionally, a spatiotemporal attention network is used to extract spatiotemporal dependent feature vectors from the spatiotemporal graph, including:

[0019] The node characteristics of each node are updated using formula (2):

[0020] (2)

[0021] in, for The first layer The node characteristics of each node. for The first layer The node characteristics of each node. For a set of nodes, for Learnable vectors of a layer for The weight matrix of the layer, For activation functions;

[0022] The attention coefficient for each node is determined using formula (3):

[0023] (3)

[0024] in, For the first The node and the first The weights of the edges between nodes. For activation function, For the transpose of a learnable vector, This is the weight matrix. For the first The node characteristics of each node. For the first The node characteristics of each node. For the first Node characteristics of each node;

[0025] The spatiotemporal dependent feature vector is extracted using formula (4):

[0026] (4)

[0027] in, It is a dilated convolution function. for The first layer The node characteristics of each node. The kernel size is [size]. This represents the void ratio.

[0028] Optionally, a federated self-supervised feature learning method is used to train and learn the spatiotemporal dependent feature vectors to obtain corresponding robust feature vectors, including:

[0029] Train the objective functions of formulas (5) and (6) on each client:

[0030] (5)

[0031] in, Let the objective function be... For temperature coefficient, For the amount of data per client, For the first The spatiotemporal dependency feature vectors of each node For the first The spatiotemporal dependency feature vectors of each node;

[0032] = (6)

[0033] in, Spatiotemporal dependent feature vectors Transpose of;

[0034] On the server side, formula (7) is used to aggregate the data volume on the client side:

[0035] (7)

[0036] in, The result of the aggregation operation. a set of clients, a data volume of the first client, a total data volume, an output of the first client.

[0037] Optionally, a dynamic feature selector is adopted to determine a feature subset according to the robust feature vector, including:

[0038] The importance weight of each feature subset is determined according to formula (8):

[0039] , (8)

[0040] wherein, is the importance weight, is a query matrix, is a key matrix, is a value matrix, is a scaling factor.

[0041] In another aspect, the present application also provides a construction system of a power smart device network flow feature information library, the construction system comprising a client and a server, and being used for executing the construction method according to any one of the above.

[0042] In still another aspect, the present application also provides a construction system of a power smart device network flow feature information library, the construction system comprising a processor, and the processor being configured to execute the construction method according to the above.

[0043] In still another aspect, the present application also provides a computer readable storage medium, the computer readable storage medium storing instructions, and the instructions being used for being read by a machine, so as to make the machine execute the construction method according to any one of the above.

[0044] Through the above technical solution, the construction method and system of the power smart device network flow feature information library provided by the present application first extracts a space-time dependent feature vector in network flow information through a space-time graph and a space-time attention network, then combines a federated self-supervised feature learning method for training and learning, so as to determine a corresponding robust feature vector, and finally determines a feature subset used for constructing a feature information library through a dynamic feature selector. Compared with the prior art, the construction method and system provided by the present application improve the accuracy of the constructed feature information library, because the network flow information is deeply associated with feature mining through the space-time graph, the space-time attention network and the federated self-supervised feature learning method before the feature subset is established.

[0045] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. Attached Figure Description

[0046] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0047] Figure 1 This is a flowchart of a method for constructing a network traffic feature information database for intelligent power devices according to an embodiment of the present invention;

[0048] Figure 2 This is a flowchart of a method for determining a spatiotemporally dependent feature vector according to an embodiment of the present invention;

[0049] Figure 3 This is a flowchart of a method for determining robust eigenvectors according to an embodiment of the present invention;

[0050] Figure 4 This is a structural block diagram of a system for constructing a network traffic characteristic information database for intelligent power devices according to an embodiment of the present invention. Detailed Implementation

[0051] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0052] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0053] like Figure 1 The diagram shows a flowchart of a method for constructing a network traffic characteristic information database for intelligent power devices according to an embodiment of the present invention. Figure 1 In this context, the construction method may include the following steps:

[0054] In step S10, network flow information to be processed is obtained;

[0055] In step S11, a spatiotemporal graph is constructed based on network flow information;

[0056] In step S12, the similarity of each node in the spatiotemporal graph is calculated using the dynamic time warping method to determine the weight of the edge between each pair of nodes;

[0057] In step S13, a spatiotemporal attention network is used to extract spatiotemporal dependent feature vectors from the spatiotemporal graph;

[0058] In step S14, the spatiotemporally dependent feature vector is trained using a federated self-supervised feature learning method to obtain the corresponding robust feature vector.

[0059] In step S15, a dynamic feature selector is used to determine a feature subset based on the robust feature vector;

[0060] In step S16, a feature information database is constructed based on the feature subset.

[0061] In such Figure 1 In the construction method shown, step S10 can be used to obtain network flow information to be processed. This network flow information can be obtained by directly accessing the network interface. The network flow can be a chain of data packets. Each data packet can have a corresponding data packet size, timestamp, and protocol type, etc.

[0062] Step S11 can be used to construct a spatiotemporal graph based on network flow information. This spatiotemporal graph can represent the relationships between each data packet in the network flow information. The method for constructing this spatiotemporal graph can be of various forms known to those skilled in the art. In one example of the present invention, the method for constructing the spatiotemporal graph can be to use individual data packets in the network flow information as nodes and the relationships between data packets as edges to construct the spatiotemporal graph. The relationships can include time features representing time intervals and the arrow direction of the edges representing the transmission direction.

[0063] Step S12 can be used to calculate the similarity of each node in the spatiotemporal graph using a dynamic time warping method to determine the weight of the edge between every two nodes. This dynamic time warping method can take many forms known to those skilled in the art. In one example of the present invention, the weight of the edge between every two nodes (data packets) can be determined using the following formula (1):

[0064] (1)

[0065] in, For the first The node and the first The weights of the edges between nodes. For smoothing coefficients, It is a dynamic time warping function. The weight adjustment function is determined based on the protocol type. , This represents the sequence of data packets. For data packets of the same protocol type, the value of this weight adjustment function can be 1; for data packets of different protocol types, the value of this weight adjustment function can be in the range of less than 1, such as 0.5.

[0066] Through steps S11 and S12, edges are only established between data packets with time-related characteristics (such as data packets that are adjacent in time order), which allows the constructed spatiotemporal graph to better reflect the temporal dependencies between data packets. The weights determined in step S12 are values ​​adjusted based on protocol type and time characteristics. Under the premise that the spatiotemporal graph can retain time characteristics, combined with the weight adjustment function, the output result can retain the characteristics of both, thereby ensuring that the output spatiotemporal graph can better reflect the actual behavior pattern of network flow data.

[0067] Step S13 can be used to extract spatiotemporal dependency feature vectors from the spatiotemporal graph using a spatiotemporal attention network. These spatiotemporal dependency feature vectors can represent the spatiotemporal correlations between various data packets. The specific method for determining these spatiotemporal dependency feature vectors can be of various forms known to those skilled in the art. In one example of this invention, it can be achieved using methods such as... Figure 2 The method shown is used to determine the spatiotemporal dependent feature vector. Specifically, in this... Figure 2 In this context, methods for determining spatiotemporally dependent feature vectors may include the following steps:

[0068] In step S20, the node features of each node are updated using formula (2):

[0069] (2)

[0070] in, for The first layer The node characteristics of each node. for The first layer The node characteristics of each node. For a set of nodes, for Learnable vectors of a layer, dimension and Same, for example ∈ ,but ∈ , for In one example of this invention, the weight matrix of the layer can have a dimension of d×d, where d is a preset value. For activation functions;

[0071] In step S21, the attention coefficient of each node is determined using formula (3):

[0072] (3)

[0073] in, For the first The node and the first The weights of the edges between nodes. As an activation function, in one example of this invention, the negative slope of this activation function can be 0.2. For the transpose of a learnable vector, This is the weight matrix. For the first The node characteristics of each node. For the first The node characteristics of each node. For the first Node characteristics of each node;

[0074] In step S22, the spatiotemporal dependent feature vector is extracted using formula (4):

[0075] (4)

[0076] in, It is a dilated convolution function. for The first layer The node characteristics of each node. The kernel size is [size]. The void ratio, in one example of this invention, It is used to capture features at different time scales.

[0077] Step S14 can be used to train the spatiotemporally dependent feature vectors using a federated self-supervised feature learning method to obtain the corresponding robust feature vectors. Since the spatiotemporally dependent feature vectors have high-dimensional feature representation due to their multi-source data characteristics, in this embodiment, to ensure in-depth feature mining, enhance feature generalization ability, and improve the model's adaptability under different data distributions, in one example of the present invention, the method for determining the robust feature vectors may include, as follows: Figure 3 The steps shown are described. Figure 3 In this context, methods for determining robust feature vectors may include the following steps:

[0078] In step S30, the objective functions of formulas (5) and (6) are trained for each client:

[0079] (5)

[0080] wherein, is the objective function, is the temperature coefficient, is the data volume of a single client, is the spatio-temporal dependency feature vector of the th node, is the spatio-temporal dependency feature vector of the th node;

[0081] , (6)

[0082] wherein, is the transpose of the spatio-temporal dependency feature vector

[0083] In step S31, the data volume of the client is aggregated on the server side using formula (7):

[0084] , (7)

[0085] wherein, is the result of the aggregation operation, is the set of clients, is the data volume of the th client, is the total data volume, is the output of the th client.

[0086] Step S15 can be used to determine the feature subset according to the robust feature vector using the dynamic feature selector. Specifically, in one example of the present application, the importance weight can be determined using the following formula (8):

[0087] , (8)

[0088] wherein, is the importance weight, is the query matrix, is the key matrix, is the value matrix, is a scaling factor used to avoid the problem of gradient disappearance caused by too large dot product values, is used to normalize the dot product result into a probability distribution.

[0089] On the other hand, the present application also provides a construction system of a power intelligent device network flow feature information library, which comprises a processor configured to execute the construction method as described above. Specifically, the construction method can comprise the following steps:

[0090] ​​In step S10, network flow information to be processed is obtained;

[0091] In step S11, a spatiotemporal graph is constructed based on network flow information;

[0092] In step S12, the similarity of each node in the spatiotemporal graph is calculated using the dynamic time warping method to determine the weight of the edge between each pair of nodes;

[0093] In step S13, a spatiotemporal attention network is used to extract spatiotemporal dependent feature vectors from the spatiotemporal graph;

[0094] In step S14, the spatiotemporally dependent feature vector is trained using a federated self-supervised feature learning method to obtain the corresponding robust feature vector.

[0095] In step S15, a dynamic feature selector is used to determine a feature subset based on the robust feature vector;

[0096] In step S16, a feature information database is constructed based on the feature subset.

[0097] In such Figure 1 In the construction method shown, step S10 can be used to obtain network flow information to be processed. This network flow information can be obtained by directly accessing the network interface. The network flow can be a chain of data packets. Each data packet can have a corresponding data packet size, timestamp, and protocol type, etc.

[0098] Step S11 can be used to construct a spatiotemporal graph based on network flow information. This spatiotemporal graph can represent the relationships between each data packet in the network flow information. The method for constructing this spatiotemporal graph can be of various forms known to those skilled in the art. In one example of the present invention, the method for constructing the spatiotemporal graph can be to use individual data packets in the network flow information as nodes and the relationships between data packets as edges to construct the spatiotemporal graph. The relationships can include time features representing time intervals and the arrow direction of the edges representing the transmission direction.

[0099] Step S12 can be used to calculate the similarity of each node in the spatiotemporal graph using a dynamic time warping method to determine the weight of the edge between every two nodes. This dynamic time warping method can take many forms known to those skilled in the art. In one example of the present invention, the weight of the edge between every two nodes (data packets) can be determined using the following formula (1):

[0100] (1)

[0101] in, For the first The node and the first The weights of the edges between nodes. For smoothing coefficients, It is a dynamic time warping function. The weight adjustment function is determined based on the protocol type. , This represents the sequence of data packets. For data packets of the same protocol type, the value of this weight adjustment function can be 1; for data packets of different protocol types, the value of this weight adjustment function can be in the range of less than 1, such as 0.5.

[0102] Through steps S11 and S12, edges are only established between data packets with time-related characteristics (such as data packets that are adjacent in time order), which allows the constructed spatiotemporal graph to better reflect the temporal dependencies between data packets. The weights determined in step S12 are values ​​adjusted based on protocol type and time characteristics. Under the premise that the spatiotemporal graph can retain time characteristics, combined with the weight adjustment function, the output result can retain the characteristics of both, thereby ensuring that the output spatiotemporal graph can better reflect the actual behavior pattern of network flow data.

[0103] Step S13 can be used to extract spatiotemporal dependency feature vectors from the spatiotemporal graph using a spatiotemporal attention network. These spatiotemporal dependency feature vectors can represent the spatiotemporal correlations between various data packets. The specific method for determining these spatiotemporal dependency feature vectors can be of various forms known to those skilled in the art. In one example of this invention, it can be achieved using methods such as... Figure 2 The method shown is used to determine the spatiotemporal dependent feature vector. Specifically, in this... Figure 2 In this context, methods for determining spatiotemporally dependent feature vectors may include the following steps:

[0104] In step S20, the node features of each node are updated using formula (2):

[0105] (2)

[0106] in, for The first layer The node characteristics of each node. for The first layer The node characteristics of each node. For a set of nodes, for Learnable vectors of a layer, dimension and Same, for example ∈ ,but ∈ , for In one example of this invention, the weight matrix of the layer can have a dimension of d×d, where d is a preset value. For activation functions;

[0107] In step S21, the attention coefficient of each node is determined using formula (3):

[0108] (3)

[0109] in, For the first The node and the first The weights of the edges between nodes. As an activation function, in one example of this invention, the negative slope of this activation function can be 0.2. For the transpose of a learnable vector, This is the weight matrix. For the first The node characteristics of each node. For the first The node characteristics of each node. For the first Node characteristics of each node;

[0110] In step S22, the spatiotemporal dependent feature vector is extracted using formula (4):

[0111] (4)

[0112] in, It is a dilated convolution function. for The first layer The node characteristics of each node. The kernel size is [size]. The void ratio, in one example of this invention, It is used to capture features at different time scales.

[0113] Step S14 can be used to train the spatiotemporally dependent feature vectors using a federated self-supervised feature learning method to obtain the corresponding robust feature vectors. Since the spatiotemporally dependent feature vectors have high-dimensional feature representation due to their multi-source data characteristics, in this embodiment, to ensure in-depth feature mining, enhance feature generalization ability, and improve the model's adaptability under different data distributions, in one example of the present invention, the method for determining the robust feature vectors may include, as follows: Figure 3 The steps shown are described. Figure 3 In this context, methods for determining robust eigenvectors may include the following steps:

[0114] In step S30, the objective functions of formulas (5) and (6) are trained for each client:

[0115] (5)

[0116] in, Let be the objective function. For temperature coefficient, For the amount of data per client, For the first The spatiotemporal dependency feature vectors of each node For the first The spatiotemporal dependency feature vectors of each node;

[0117] = (6)

[0118] in, Spatiotemporal dependent feature vectors Transpose of;

[0119] In step S31, the server performs an aggregation operation on the client's data volume using formula (7):

[0120] (7)

[0121] in, The result of the aggregation operation. A collection of clients, For the first Data volume per client Total data volume For the first Output from each client.

[0122] Step S15 can be used to determine a feature subset based on a robust feature vector using a dynamic feature selector. Specifically, in one example of the present invention, the importance weight can be determined using the following formula (8):

[0123] (8)

[0124] in, As importance weight, For querying the matrix, The key matrix, For value matrices, This is a scaling factor used to avoid the gradient vanishing problem caused by excessively large dot product values. This is used to normalize the dot product result into a probability distribution.

[0125] Furthermore, this invention also provides a system for constructing a network traffic characteristic information database for intelligent power devices, such as... Figure 4 As shown, the construction system includes a client and a server for executing the construction method as described above. Furthermore, the client can also be used to train the objective functions of formulas (5) and (6):

[0126] (5)

[0127] in, Let be the objective function. For temperature coefficient, For the amount of data per client, For the first The spatiotemporal dependency feature vectors of each node For the first The spatiotemporal dependency feature vectors of each node;

[0128] = (6)

[0129] in, Spatiotemporal dependent feature vectors The transpose of .

[0130] The server can then be used to aggregate the client's data using formula (7):

[0131] (7)

[0132] in, The result of the aggregation operation. A collection of clients, For the first Data volume per client Total data volume For the first Output from each client.

[0133] In another aspect, the present invention also provides a computer-readable storage medium storing instructions for being read by a machine to cause the machine to perform any of the construction methods described above.

[0134] Through the above technical solution, the embodiments of the present invention provide a method and system for constructing a network traffic feature information database for intelligent power devices. This method and system first extract spatiotemporal dependent feature vectors from network flow information using spatiotemporal graphs and spatiotemporal attention networks. Then, it combines this with a federated self-supervised feature learning method for training and learning, thereby determining the corresponding robust feature vectors. Finally, a dynamic feature selector determines the feature subset used to construct the feature information database. Compared with existing technologies, the construction method and system provided by the present invention improves the accuracy of the constructed feature information database by performing deep correlation feature mining on network flow information through spatiotemporal graphs, spatiotemporal attention networks, and federated self-supervised feature learning methods before establishing the feature subset.

[0135] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0137] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0138] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0139] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0140] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0141] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0142] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0143] The above merely provides an example of the present application, and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall fall into the scope of claims of the present application.

Claims

1. A method for constructing a network traffic characteristic information database for intelligent power devices, characterized in that, include: Obtain network flow information to be processed; Construct a spatiotemporal graph based on the network flow information; The similarity of each node in the spatiotemporal graph is calculated using the dynamic time warping method to determine the weight of the edge between any two nodes. A spatiotemporal attention network is used to extract the spatiotemporal dependency feature vectors from the spatiotemporal graph; The spatiotemporal dependent feature vectors are trained and learned using a federated self-supervised feature learning method to obtain the corresponding robust feature vectors. A dynamic feature selector is used to determine a feature subset based on the robust feature vector; A feature information database is constructed based on the aforementioned feature subset; The spatiotemporal dependent feature vectors are trained using a federated self-supervised feature learning method to obtain corresponding robust feature vectors, including: Train the objective functions of formulas (5) and (6) on each client: ，（5） in, Let the objective function be... For temperature coefficient, For the amount of data per client, For the first The spatiotemporal dependency feature vectors of each node For the first The spatiotemporal dependency feature vectors of each node; = ，（6） in, Spatiotemporal dependent feature vectors Transpose of; On the server side, formula (7) is used to aggregate the data volume on the client side: ，（7） in, The result of the aggregation operation. A collection of clients, For the first Data volume per client Total data volume For the first The output of each client; A dynamic feature selector is used to determine a feature subset based on the robust feature vector, including: The importance weight of each feature subset is determined according to formula (8): ，（8） in, As importance weight, For querying the matrix, The key matrix, For value matrices, This is the scaling factor.

2. The construction method according to claim 1, characterized in that, Constructing a spatiotemporal graph based on the network flow information includes: The spatiotemporal graph is constructed by taking individual data packets in the network flow information as nodes and the relationships between data packets as edges. The relationships include time features representing time intervals and arrow directions representing transmission directions.

3. The construction method according to claim 1, characterized in that, The dynamic time warping method is used to calculate the similarity of each node in the spatiotemporal graph to determine the weight of the edges between any two nodes, including: The weight of the edge between any two nodes is determined using formula (1): ，（1） in, For the first The node and the first The weights of the edges between nodes. For smoothing coefficients, It is a dynamic time warping function. This is a weight adjustment function determined based on the protocol type.

4. The construction method according to claim 1, characterized in that, The spatiotemporal dependency feature vectors in the spatiotemporal graph are extracted using a spatiotemporal attention network, including: The node characteristics of each node are updated using formula (2): ，（2） in, for The first layer The node characteristics of each node. for The first layer The node characteristics of each node. For a set of nodes, for Learnable vectors of a layer for The weight matrix of the layer, For activation functions; The attention coefficient for each node is determined using formula (3): ，（3） in, For the first The node and the first The weights of the edges between nodes. For activation function, For the transpose of a learnable vector, This is the weight matrix. For the first The node characteristics of each node. For the first The node characteristics of each node. For the first Node characteristics of each node; The spatiotemporal dependent feature vector is extracted using formula (4): ，（4） in, It is a dilated convolution function. for The first layer The node characteristics of each node. The kernel size is [size]. This represents the void ratio.

5. A system for constructing a network traffic characteristic information database for intelligent power devices, characterized in that, The build system includes a processor configured to perform the build method as described in any one of claims 1 to 4.

6. A system for constructing a network traffic characteristic information database for intelligent power devices, characterized in that, The building system includes a client and a server for executing the building method as described in claim 1.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that are read by a machine to cause the machine to perform the construction method as described in any one of claims 1 to 4.

Images