Electric power industrial control flow application layer message anomaly detection method and device and electronic equipment

Abstract

The invention discloses an electric power industrial control flow application layer message anomaly detection method and device and electronic equipment. The method comprises the steps of collecting industrial control network full messages of an electric power system in real time; based on a preset industrial control protocol behavior characteristic spectrum, screening out suspicious traffic fragments deviating from a normal communication normal form from the industrial control network total message to generate a suspicious traffic event chain; performing protocol field regularization processing on the suspicious traffic event chain to extract a cross-level attack feature set; inputting the cross-level attack feature set into an attack identification model subjected to federal learning training for multiple rounds of verification to obtain a determined attack sample of which the attack confidence meets a preset standard; and determining an attack category and a propagation path based on attack sample traceability through the attack characteristic pedigree. According to the method, unknown attacks are captured through a protocol behavior characteristic spectrum, the recognition capability is improved through cross-level characteristic extraction, error and missing report are reduced through federated learning and multi-round verification, and the whole attack process is tracked through event chain and pedigree tracing.

Description

Technical Field

[0001] This application relates to the field of power technology, and in particular to a method, device and electronic equipment for detecting abnormal messages in the power industrial control flow application layer. Background Technology

[0002] With the accelerated development of intelligent power systems, industrial control networks have become a core infrastructure for ensuring stable power operation, carrying critical data transmission for substation automation control, distribution terminal monitoring, and load dispatching. However, industrial control networks face increasingly severe cyberattack threats. A cyberattack can lead to abnormal power equipment shutdowns, data leaks, and even large-scale power outages. Therefore, accurate identification of attack behaviors within industrial control network traffic is of significant practical importance.

[0003] Currently, attack identification targeting power industrial control traffic mostly employs static detection methods based on feature libraries. These methods pre-define signature codes of known attacks (such as specific malicious command sequences or abnormal port access patterns) and perform feature matching on collected traffic data. When a traffic segment matching a record in the feature library is detected, it is determined to be an attack. Simultaneously, some solutions incorporate simple threshold judgment mechanisms, such as setting a range for message length fluctuations or an upper limit for command interaction frequency; exceeding these thresholds triggers an alarm.

[0004] The existing solutions mentioned above rely too heavily on known attack signature databases, have weak ability to identify unknown or mutated attacks, and are unable to cope with the dynamic evolution of attack methods. Moreover, the threshold settings are mostly fixed values, which cannot adapt to the differences in communication characteristics of different protocols and time periods in power industrial control networks, which easily leads to high false alarm and false negative rates. Especially in complex attack scenarios, it is difficult to effectively trace the complete chain and root cause of the attack, which poses a significant threat to the security protection of power systems. Summary of the Invention

[0005] This application provides a method, apparatus, and electronic device for detecting abnormal messages in the power industrial control flow application layer, in order to solve or alleviate the technical defects in the prior art.

[0006] A method for detecting anomalies in power industrial control flow application layer messages includes the following steps:

[0007] Step 1: Real-time acquisition of all packets from the power system's industrial control network;

[0008] Step 2: Based on the preset industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages to generate suspicious traffic event chains;

[0009] Step 3: Perform protocol field normalization on the suspicious traffic event chain to extract cross-level attack feature sets;

[0010] Step 4: Input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets the preset standard.

[0011] Step 5: Determine the attack category and propagation path based on the attack sample source by using the attack feature spectrum.

[0012] Optionally, step 1 involves real-time acquisition of all packets from the power system's industrial control network, specifically including:

[0013] Step 11: Obtain multi-protocol messages collected from key communication links deployed in the power industrial control network;

[0014] Step 12: Timestamp alignment of multi-protocol messages to build an initial full message database containing message arrival time, protocol type, source / destination address, and payload content;

[0015] Step 13: Perform integrity verification on the initial full message database, and remove damaged message data during transmission by CRC redundancy check to obtain a valid full message database.

[0016] Optionally, step 2, based on a preset industrial control protocol behavior feature map, filters out suspicious traffic segments that deviate from normal communication patterns from the full volume of industrial control network packets to generate a suspicious traffic event chain, specifically including:

[0017] Step 21: Calculate the matching degree between each message sequence in the full set of industrial control network messages and the corresponding protocol behavior pattern in the industrial control protocol behavior feature map, so as to generate a behavior deviation quantification value;

[0018] Step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the deviation quantification value of the packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment.

[0019] Step 23: Perform correlation analysis on the marked suspicious traffic segments, merge segments belonging to the same communication session, and form a suspicious traffic event chain.

[0020] Optionally, step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the behavioral deviation quantification of a packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Specifically, this includes:

[0021] Step 221: Construct a protocol type-threshold mapping table. For different industrial control protocols, initialize their respective baseline deviation thresholds based on the behavioral deviation distribution characteristics of historical normal communication samples.

[0022] Step 222: Based on the protocol communication load fluctuation coefficient, monitor the communication busyness of each protocol in the current time period corresponding to the message sequence in real time, and dynamically adjust the baseline deviation threshold to obtain the adjusted deviation threshold.

[0023] Step 223: When the behavior of a message sequence deviates from the quantified value by more than the adjusted deviation threshold, it is marked as a suspicious traffic segment.

[0024] Optionally, step 3 involves performing protocol field normalization on suspicious traffic segments to extract cross-layer attack feature sets, specifically including:

[0025] Step 31: Build an event chain parsing engine to perform session integrity verification on the suspicious traffic event chain, and associate scattered traffic fragments of the same attack event through session identifiers to form an attack behavior sequence;

[0026] Step 32: For the attack behavior sequence, use protocol field layered parsing to extract the private fields of different industrial control protocols in a structured manner, and convert the unstructured payload data into quantifiable feature parameters containing field offsets, data types and verification values.

[0027] Step 33: Based on the temporal position of the fields in the suspicious traffic event chain and their correlation with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the corresponding session initialization stage and command execution stage in the suspicious traffic event chain;

[0028] Step 34: Map heterogeneous fields from different industrial control protocols to a unified feature space and construct a standardized field matrix that includes the timestamp dimension;

[0029] Step 35: Based on the standardized field matrix and key fields, perform cross-event chain feature extraction to generate a cross-level attack feature set, which includes protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

[0030] Optionally, step 4 involves inputting the cross-level attack feature set into an attack identification model trained through federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets a preset standard. This specifically includes:

[0031] Step 41: Perform feature dimension verification on the cross-level attack feature set, use principal component analysis combined with maximum information coefficient to screen core features, remove redundant features, and at the same time perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set;

[0032] Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set.

[0033] Step 43: Initiate a three-round progressive verification mechanism. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. The comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

[0034] Optionally, step 5, determining the attack category and propagation path based on attack sample tracing through attack feature genealogy, specifically includes:

[0035] Step 51: Extract the core feature vector of the identified attack sample, including abnormal patterns of protocol fields, command interaction sequences, target device type, and attack payload characteristics;

[0036] Step 52: Calculate the similarity matrix between the core feature vector and the features of each node in the attack feature spectrum;

[0037] Step 53: When the maximum similarity in the similarity matrix exceeds the spectrum matching threshold, trace the corresponding attack category node in the attack feature spectrum, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

[0038] Optionally, step 53: When the maximum similarity in the similarity matrix exceeds the lineage matching threshold, trace the corresponding attack category node in the attack feature lineage, and determine the attack propagation path by combining the propagation feature library associated with the attack category node, specifically including:

[0039] Step 531: Based on the index value corresponding to the maximum similarity in the similarity matrix, locate the matching attack category node in the attack feature spectrum, extract the attack type identifier, typical attack vector and historical propagation record stored in the node, and generate attack category benchmark information.

[0040] Step 532: Extract propagation feature parameters from the attack category baseline information, retrieve typical propagation ports, device penetration priorities and communication protocol preferences of this type of attack from the propagation feature library associated with the attack category nodes, and construct a preliminary propagation pattern outline.

[0041] Step 533: Perform time-series correlation processing on the preliminary propagation pattern outline. Dynamically compare the source / destination device sequence and message interaction timing in the determined attack sample with the propagation pattern outline. Use the time-series correlation algorithm to filter out potential propagation chains that conform to the propagation rules.

[0042] Step 534: Perform topology reachability verification on potential propagation chains. Combine the physical topology map of the power industrial control network to verify the actual connection relationship of each device on the link, eliminate false paths that are topologically unreachable, and finally determine the actual propagation path of the attack in the physical network.

[0043] A power industrial control flow application layer message anomaly detection device, comprising:

[0044] The data acquisition unit is used to collect all messages from the industrial control network of the power system in real time.

[0045] The filtering unit is used to filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages based on a preset industrial control protocol behavior feature map in order to generate a suspicious traffic event chain.

[0046] The normalization unit is used to perform protocol field normalization processing on suspicious traffic event chains in order to extract cross-level attack feature sets;

[0047] The verification unit is used to input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain a confirmed attack sample whose attack confidence meets the preset standard.

[0048] The attack identification unit is used to determine the attack category and propagation path based on the attack sample by tracing the attack feature spectrum.

[0049] An electronic device includes a memory and a processor, wherein a computer-executable program is stored in the memory, and the processor runs the computer-executable program to implement the method described in any of the embodiments of this application.

[0050] In this embodiment, suspicious traffic segments deviating from normal communication paradigms are screened based on a preset industrial control protocol behavior feature map. This is no longer limited to known attack characteristics and can capture various anomalies deviating from normal paradigms, including unknown and mutated attacks. By performing protocol field normalization on the suspicious traffic event chain and extracting cross-level attack feature sets, attack-related features can be comprehensively mined, improving the ability to identify new types of attacks. Furthermore, screening based on the preset industrial control protocol behavior feature map can be combined with the characteristics of different protocols. By inputting the cross-level attack feature set into an attack identification model trained through federated learning for multiple rounds of verification, federated learning training enables the model to adapt to different scenarios, and the multi-round verification mechanism can dynamically adjust the judgment criteria, reducing false positive and false negative rates. Generating suspicious traffic event chains can integrate attack-related scattered traffic and determine the attack category and propagation path based on attack sample tracing through the attack feature spectrum. This clearly tracks the complete process and root cause of the attack, providing accurate evidence for power system security protection. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a flowchart illustrating a method for detecting abnormal messages in the power industrial control flow application layer, according to an embodiment of this application.

[0053] Figure 2 This is a schematic diagram of the structure of a power industrial control flow application layer message anomaly detection device according to an embodiment of this application.

[0054] Figure 3 This is a schematic diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] like Figure 1 As shown in the figure, this application embodiment provides a method for detecting anomalies in power industrial control flow application layer messages, which includes the following steps:

[0057] Step 1: Real-time acquisition of all packets from the power system's industrial control network;

[0058] Step 2: Based on the preset industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages to generate suspicious traffic event chains;

[0059] Step 3: Perform protocol field normalization on the suspicious traffic event chain to extract cross-level attack feature sets;

[0060] Step 4: Input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets the preset standard.

[0061] Step 5: Determine the attack category and propagation path based on the attack sample source by using the attack feature spectrum.

[0062] Optionally, step 1 involves real-time acquisition of all packets from the power system's industrial control network, specifically including:

[0063] Step 11: Obtain multi-protocol messages collected from key communication links deployed in the power industrial control network;

[0064] Step 12: Timestamp alignment of multi-protocol messages to build an initial full message database containing message arrival time, protocol type, source / destination address, and payload content;

[0065] Step 13: Perform integrity verification on the initial full message database, and remove damaged message data during transmission by CRC redundancy check to obtain a valid full message database.

[0066] Preferably, in step 11, distributed traffic acquisition nodes based on industrial-grade embedded chips (such as the ARM Cortex-A9 architecture) are deployed at key communication link locations such as redundant ports of core switches in the power industrial control network and serial interfaces of substation communication gateways. These nodes have built-in 1000BASE-T adaptive Ethernet interfaces to adapt to links of different speeds. These nodes replicate all bidirectional packets flowing through the link by enabling port mirroring (SPAN technology). For protocol packets such as Modbus RTU / ASCII, OPCUA over TCP, and EtherNet / IP, a dedicated protocol preprocessing chip is used for real-time frame synchronization to ensure a packet boundary identification accuracy of over 99.9%. The acquisition nodes store the captured packets in 512KB blocks in their local DDR4 cache. When the cache occupancy reaches 80%, a data transfer mechanism is triggered, and the data is transmitted to the backend storage server through an encrypted channel to avoid data overflow and loss in high-traffic scenarios.

[0067] Preferably, in step 12, time synchronization calibration is performed on the multi-protocol messages uploaded by the distributed nodes. Each acquisition node has a built-in high-precision RTC clock module (clock deviation ≤ 1ppm) and performs periodic time synchronization with the power system time server (Stratum 2 level) via the NTPv4 protocol, with a synchronization period of 1 minute / time. For cross-node messages in the same communication session, the TCP sequence number or application layer session identifier is extracted and associated, and a linear interpolation algorithm is used to correct the timestamp deviation between different nodes (correction accuracy controlled within ±5ms) to ensure timing consistency. The calibrated messages are timestamped in the format of "year-month-day-hour-minute-second-millisecond" and stored sequentially in a PostgreSQL-based time series database. An initial full message database is constructed, containing message arrival time, protocol type (identified by dual identification of port number and protocol signature), source / destination IP address (including IPv4 / IPv6 dual-stack support), transport layer port number, application layer function code, and hexadecimal payload data. The database adopts a partitioned table design, automatically partitioned by hourly granularity to improve query efficiency.

[0068] Preferably, for step 13, a three-level integrity verification mechanism is initiated for each message in the initial full message database. The first level verifies the CRC32 field of the Ethernet frame by calculating the Frame Check Sequence (FCS) using a hardware acceleration module and comparing it with the frame tail check value. The second level verifies the matching of function codes and data lengths for application layer protocols, such as Modbus protocol, and verifies the consistency of message header and message body lengths for OPCUA protocol. The third level adds SHA-256 hash verification to critical control command messages (such as circuit breaker opening and closing commands) to ensure command integrity. Messages that fail verification are marked as "invalid" and the reason for failure is recorded (such as CRC error, length abnormality, command tampering). Finally, complete messages that pass all three levels of verification are selected from the initial database, re-indexed according to protocol type and time range, and a valid full message database supporting millisecond-level query response is generated. The database also enables a data backup mechanism, generating incremental backups hourly and full backups daily to ensure data traceability.

[0069] Optionally, step 2, based on a preset industrial control protocol behavior feature map, filters out suspicious traffic segments that deviate from normal communication patterns from the full volume of industrial control network packets to generate a suspicious traffic event chain, specifically including:

[0070] Step 21: Calculate the matching degree between each message sequence in the full set of industrial control network messages and the corresponding protocol behavior pattern in the industrial control protocol behavior feature map, so as to generate a behavior deviation quantification value;

[0071] Step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the deviation quantification value of the packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment.

[0072] Step 23: Perform correlation analysis on the marked suspicious traffic segments, merge segments belonging to the same communication session, and form a suspicious traffic event chain.

[0073] Preferably, in step 21, message data categorized by protocol type is retrieved from the valid full message database. Different time windows are set for each protocol (e.g., a 5-second window for Modbus and a 15-second window for OPCUA). Interaction messages with the same source / destination IP address and port pair within each window are extracted to form a message sequence. Protocol-specific features are parsed from the message sequence, including Modbus function code sequences, OPCUA service call types, and EtherNet / IP message priority identifiers. At the same time, general features such as message interval standard deviation, command retransmission rate, and load length variation coefficient are extracted. These features are compared item by item with the standard mode features of the corresponding protocol in the industrial control protocol behavior feature map. The overall consistency is calculated by weighted summation (the weights are preset according to the importance of the features to attack identification). The difference between 1 and the consistency is used as the behavioral deviation metric, which ranges from 0 to 1, where 0 represents a complete match to the normal mode and 1 represents a complete deviation.

[0074] Preferably, in step 23, all traffic segments marked as suspicious are aggregated, and a timestamp index and protocol type label are added to each segment; multi-level session identifiers of each segment are extracted, including the network layer IP 5-tuple (source IP, destination IP, protocol type, source port, destination port), the transport layer session sequence number, and the application layer transaction identifier (such as Modbus transaction processing identifier); an association rule base is constructed based on the multi-level session identifiers. For example, when the IP 5-tuples of two segments match completely and the application layer transaction identifiers are consecutive, they are determined to be the same session; suspicious traffic segments are clustered and grouped according to the association rule base, and segments in the same group are arranged in ascending order of timestamp to form a preliminary sequence; logical verification is performed on the preliminary sequence to check the correspondence between request and response messages in the sequence (such as Modbus request function code 0x03 should correspond to a response message containing data), the legality of command interaction (such as write commands must contain a legal address range), and abnormal segments with logical breaks are eliminated; the segments that pass the verification are integrated into a suspicious traffic event chain, which contains a complete event trajectory such as session establishment time, key command sequence, abnormal behavior trigger point, and session termination status.

[0075] Optionally, step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the behavioral deviation quantification of a packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Specifically, this includes:

[0076] Step 221: Construct a protocol type-threshold mapping table. For different industrial control protocols, initialize their respective baseline deviation thresholds based on the behavioral deviation distribution characteristics of historical normal communication samples.

[0077] Step 222: Based on the protocol communication load fluctuation coefficient, monitor the communication busyness of each protocol in the current time period corresponding to the message sequence in real time, and dynamically adjust the baseline deviation threshold to obtain the adjusted deviation threshold.

[0078] Step 223: When the behavior of a message sequence deviates from the quantified value by more than the adjusted deviation threshold, it is marked as a suspicious traffic segment.

[0079] Preferably, in step 221, when constructing the protocol type-threshold mapping table and initializing the respective baseline deviation thresholds for different industrial control protocols based on the behavioral deviation distribution characteristics of historical normal communication samples, 30 consecutive days of normal communication traffic data are obtained from the traffic acquisition system and classified and stored according to protocol type (Modbus, DNP3, OPCUA, etc.); for each protocol, behavioral features of 20+ dimensions such as message field length, instruction execution cycle, and response time are extracted, and the historical distribution curve of each feature is calculated; the kernel density estimation (KDE) algorithm is used to generate the probability density function of the feature space, and the feature fluctuation range under the 95% confidence interval is obtained through Monte Carlo sampling; the comprehensive deviation index is calculated based on the feature fluctuation range, and the initial baseline threshold is determined by the ternary method, forming a multi-dimensional mapping table containing protocol type, feature weight vector, and baseline threshold; to improve the threshold adaptability, a parameter optimization mechanism based on genetic algorithm is designed to automatically adjust the weights of each feature through simulated evolution process, so that the threshold can both cover normal fluctuations and sensitively capture abnormal behavior.

[0080] Preferably, in step 222, based on the protocol communication load fluctuation coefficient, the communication busyness of each protocol in the current time period corresponding to the message sequence is monitored in real time. When the adjusted deviation threshold is obtained by dynamically adjusting the benchmark deviation threshold, distributed traffic monitoring nodes are deployed to implement fine-grained monitoring of each protocol communication link, and load indicators such as the number of messages, byte traffic, and number of connections within a 5-minute sliding window are collected. Time series decomposition technology is used to decompose the load data into trend items, seasonal items, and residual items to identify periodic traffic patterns. The fluctuation coefficient of the current time period load and the historical load of the same period is calculated, and the fluctuation coefficient = (current load - historical mean) / historical standard deviation. A threshold dynamic adjustment function is constructed. When the fluctuation coefficient exceeds 1.5 times the standard deviation, the benchmark threshold is relaxed according to the exponential decay function (relaxation range = benchmark threshold × e^(-k × fluctuation coefficient), where k is the protocol sensitivity coefficient). An autoregressive integral moving average model (ARIMA) is introduced to predict the load trend in the next 5 minutes, so as to realize the forward adjustment of the threshold and reduce false alarms caused by sudden traffic.

[0081] Preferably, in step 223, when the behavioral deviation quantification value of a message sequence exceeds the adjusted deviation threshold, and it is marked as a suspicious traffic segment, a parallel computing framework is used to quickly compare the real-time calculated behavioral deviation quantification value with the dynamically adjusted threshold. A two-layer filtering mechanism is designed: the first layer uses a Bloom filter for rapid screening, and the second layer uses an exact matching algorithm for confirmation. For message sequences exceeding the threshold, suspicious tags containing timestamps, protocol types, deviation values, and triggering features are automatically generated. A multi-dimensional anomaly scoring system is constructed, combining factors such as deviation degree, duration, and impact range to calculate a comprehensive risk score. The DS evidence theory is applied to integrate multi-source judgment criteria, and the credibility of the tag is improved when multiple features trigger anomalies simultaneously. Suspicious traffic segments are stored in an anomaly event database based on a graph database, establishing a correlation with asset information and historical attack cases to provide contextual support for subsequent analysis.

[0082] Optionally, step 3 involves performing protocol field normalization on suspicious traffic segments to extract cross-layer attack feature sets, specifically including:

[0083] Step 31: Build an event chain parsing engine to perform session integrity verification on the suspicious traffic event chain, and associate scattered traffic fragments of the same attack event through session identifiers to form an attack behavior sequence;

[0084] Step 32: For the attack behavior sequence, use protocol field layered parsing to extract the private fields of different industrial control protocols in a structured manner, and convert the unstructured payload data into quantifiable feature parameters containing field offsets, data types and verification values.

[0085] Step 33: Based on the temporal position of the fields in the suspicious traffic event chain and their correlation with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the corresponding session initialization stage and command execution stage in the suspicious traffic event chain;

[0086] Step 34: Map heterogeneous fields from different industrial control protocols to a unified feature space and construct a standardized field matrix that includes the timestamp dimension;

[0087] Step 35: Based on the standardized field matrix and key fields, perform cross-event chain feature extraction to generate a cross-level attack feature set, which includes protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

[0088] Preferably, in step 31, an event chain parsing engine is constructed. This engine integrates a protocol parsing module, a session association module, and an integrity verification module. First, it extracts multi-level session identifiers from each segment of the suspicious traffic event chain, including the network layer's IP 5-tuple, the transport layer's TCP sequence number / UUID session identifier, and the application layer's transaction ID (such as Modbus's transaction processing identifier or OPCUA's session handle). The session association module uses an improved DBSCAN clustering algorithm to group scattered segments with the same or consecutive session identifiers. During the grouping process, a time decay factor is introduced, prioritizing the association of adjacent segments with a time interval of less than 10 seconds. The integrity verification module performs a full lifecycle verification on the grouped segment sequence, checking whether the session contains a complete "establishment-interaction-termination" cycle. For missing intermediate segments, intelligent filling is performed using an LSTM prediction model based on historical interaction patterns (filling accuracy ≥ 92%). Finally, the segments that pass the verification are arranged in ascending order by timestamp to form a complete attack behavior sequence containing the attack from initiation to spread. This sequence includes metadata such as session duration, total number of interaction commands, and abnormal interruption markers.

[0089] Preferably, in step 32, a three-layer parsing architecture of "physical layer - protocol layer - application layer" is adopted for the attack behavior sequence. The physical layer parsing module extracts link characteristics such as transmission rate fluctuation and signal attenuation coefficient of the packet. The protocol layer parsing module extracts private fields such as Modbus function code extension field, DNP3 object group mutation field, and OPCUA node attribute tampering field by calling a custom industrial control protocol parsing rule library (with built-in parsing logic for 200+ protocol private fields). The unstructured hexadecimal payload data is converted into quantifiable feature parameters that include field offset (accurate to byte), data type (such as INT16 / BOOL / STRING), check value (including CRC16 / 32 double check), and field interaction dependency relationship (such as the sequential association between "write command" and "acknowledgment command"). To adapt to heterogeneous protocols, the parsing rule library supports dynamic expansion. New protocol field parsing logic can be added in real time through a visual rule editor, and the parsing latency is controlled within 5ms.

[0090] Preferably, in step 33, based on the attack behavior stage segmentation model, the suspicious traffic event chain is divided into five key stages: session initialization, command detection, privilege escalation, data theft, and trace erasure. Each stage corresponds to a different field importance weight. The correlation between the field and the attack behavior sequence is calculated through the attack influence factor, where the influence factor = (field occurrence frequency × field mutation rate × target device importance), and the target device importance is dynamically obtained from the power system asset weight library. The cleaning weight is optimized in real time using a reinforcement learning algorithm, with the goal of maximizing the ratio of "number of key fields retained / total number of fields". The retention threshold of fields in each stage is iteratively adjusted (the field retention threshold for the initialization stage is set to 0.8, and for the command execution stage it is set to 0.95). During the cleaning process, an adaptive filtering algorithm is used to remove redundant fields transmitted repeatedly (such as the same heartbeat packet field with an interval of less than 1 second) and noise fields caused by electromagnetic interference (such as incomplete fields due to CRC check failure). Finally, key information such as the identity authentication field in the session initialization stage and the control command field in the command execution stage are retained, laying a high-quality data foundation for subsequent feature extraction.

[0091] Optionally, step 4 involves inputting the cross-level attack feature set into an attack identification model trained through federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets a preset standard. This specifically includes:

[0092] Step 41: Perform feature dimension verification on the cross-level attack feature set, use principal component analysis combined with maximum information coefficient to screen core features, remove redundant features, and at the same time perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set;

[0093] Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set.

[0094] Step 43: Initiate a three-round progressive verification mechanism. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. The comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

[0095] Preferably, in step 41, the dimensionality integrity of the cross-level attack feature set is verified. A subset of effective features with a missing rate below 5% is selected by calculating the feature missing rate (missing rate = number of missing features / total number of features). Principal component analysis is used to linearly reduce the dimensionality of the effective feature subset, retaining principal components with a cumulative contribution rate exceeding 95%. Simultaneously, the maximum information coefficient is introduced to calculate the nonlinear correlation between features, eliminating redundant features with a correlation exceeding 0.85. To highlight key attack features, an adaptive enhancement mechanism based on the attack scenario is designed, assigning dynamic amplification factors (factor value = 1 + frequency of feature occurrence in historical attacks / total number of attack samples) to core features such as "instruction tampering features" and "lateral movement path features." Targeted enhancement is achieved through a feature weighting matrix, ultimately resulting in an optimized feature set with reduced dimensions and prominent key features. This process compresses the processing time to less than 100ms using a parallel computing framework.

[0096] Preferably, in step 42, the optimized feature set is input into the federated feature fusion layer of the attack identification model. This layer calls the global feature mapping matrix generated by federated learning training. The matrix elements are encrypted and aggregated by the local model parameters of each regional substation, supporting dynamic alignment of feature spaces of different substations. The fusion layer has a built-in regional feature adapter, which allocates initial weights to each regional feature space according to the historical attack identification accuracy of the substation (the higher the accuracy, the larger the weight ratio). The weights are adjusted in real time through an improved attention mechanism. The mechanism is based on the "matching degree between the current feature and the typical attack features of the region", and dynamically increases the weight ratio of high-matching regions to achieve differentiated fusion of cross-regional consistent feature sets. The fusion process introduces a feature conflict resolution strategy. When there is a contradiction between the features of different regions, the features of regions with more associated devices are given priority, and finally a fused feature vector that takes into account both global consistency and regional specificity is generated.

[0097] Preferably, in step 43, a three-round progressive verification mechanism is initiated. In the first round, the fused feature vector is inferred in parallel through the basic classifier ensemble module (which includes three sub-models: random forest, gradient boosting tree, and lightweight neural network). The initial attack confidence is calculated using a weighted voting method (the weights of the sub-models are dynamically allocated based on historical accuracy). In the second round, the real-time status database of the power equipment is called to extract parameters such as the current load rate of the equipment, communication link quality, and the action status of protection devices. A status influence factor (factor value = 1 - probability of abnormal equipment operation) is constructed, and this factor is used to correct the initial attack confidence. The process involves obtaining an optimized attack confidence score that closely matches the actual state of the device. In the final round, the optimized attack confidence score is deeply correlated with the attack feature genealogy library. The genealogy fit is calculated by feature path matching (matching the evolution path of attack features in the genealogy tree), and the fit is used to perform a secondary verification of the optimized attack confidence score. The overall confidence score is calculated using a hierarchical weighted algorithm (0.4 in the first round, 0.3 in the second round, and 0.3 in the final round). When the overall confidence score exceeds a preset threshold (0.9 by default), the corresponding suspicious traffic event chain is marked as a confirmed attack sample. At the same time, the verification details of each round are recorded for model iteration and optimization.

[0098] Specifically, in step 43, in the first round, the random forest consists of 100 CART decision trees. Each tree is trained based on different random subsets of the fused feature vector. For discrete fields in the features (such as protocol type identifiers), Gini coefficient splitting is used, and for continuous fields (such as time intervals), squared error splitting is used. The attack probability of a single tree is output and the average is taken as the sub-model result. The gradient boosting tree uses the decision tree as a weak learner. In the first round, the tree fits the initial error between the fused feature vector and the attack label. In each subsequent round, the tree iteratively optimizes the residual of the previous model, focusing on strengthening the capture of key features such as "instruction anomaly frequency" and "device interaction mutation". The attack probability is output after 30 rounds of cumulative iteration. The lightweight neural network adopts a 3-layer fully connected structure (input layer - hidden layer - output layer). The input layer standardizes the fused feature vector, the hidden layer extracts non-linear correlation features through the ReLU activation function, and the output layer outputs the attack probability using the Sigmoid function. The model is compressed to less than 1MB through knowledge distillation technology to ensure real-time performance. The inference results of the three sub-models are aggregated using a weighted voting method. The weights are dynamically allocated based on the accuracy of the most recent 1000 validations (weight = sub-model accuracy / total accuracy of the three sub-models) to generate an initial attack confidence. In the second round, the real-time status database of the power equipment is called to extract parameters such as the current load rate (ratio to rated load), communication link packet loss rate, and protection device action signals. The comprehensive abnormal operation probability is calculated using the equipment anomaly probability model (increase the probability by 0.2 when the load rate exceeds 90%, by 0.3 when the packet loss rate exceeds 5%, and by 0.5 when the protection device activates). This comprehensive abnormal operation probability is then substituted into the state influence factor formula (factor value = 1 - abnormal operation probability) to correct the initial attack confidence (corrected confidence = initial confidence × factor value) to obtain an optimized attack confidence that better reflects the actual state of the equipment. In the final round, the optimized attack confidence is correlated with the attack feature spectrum database. The system uses a tree structure to store the evolution paths of attack features (the root node represents the original attack feature, and the child nodes represent the mutated features). The optimal matching path is determined by calculating the matching degree between the current attack feature and each path in the tree (matching degree = average similarity rate of features on the path). The path matching degree is then used to perform a secondary verification of the optimized attack confidence (verified confidence = optimized confidence × matching degree). The overall confidence is calculated using a hierarchical weighted algorithm (first round weight 0.4, reflecting the model's stable identification ability; second round 0.3, related to the real-time status of the device; final round 0.3, reflecting the evolutionary pattern of the attack features). When the overall confidence exceeds a preset threshold (default 0.9), the corresponding suspicious traffic event chain is marked as a confirmed attack sample. Simultaneously, the single-round output of the three sub-models, device status parameters, and tree matching details are recorded for subsequent optimization of sub-model weights and verification thresholds.

[0099] Optionally, step 5, determining the attack category and propagation path based on attack sample tracing through attack feature genealogy, specifically includes:

[0100] Step 51: Extract the core feature vector of the identified attack sample, including abnormal patterns of protocol fields, command interaction sequences, target device type, and attack payload characteristics;

[0101] Step 52: Calculate the similarity matrix between the core feature vector and the features of each node in the attack feature spectrum;

[0102] Step 53: When the maximum similarity in the similarity matrix exceeds the spectrum matching threshold, trace the corresponding attack category node in the attack feature spectrum, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

[0103] Preferably, in step 51, the complete traffic data packet of the identified attack sample is obtained, and it is structurally parsed using a feature-layered extraction framework. First, abnormal patterns of protocol fields are extracted from the protocol syntax layer, including field length mutation points (e.g., Modbus function code field changes from 1 byte to 3 bytes), checksum mismatch locations, and non-standard padding content for private fields. The degree of variation (slight / moderate / severe) is marked for each abnormal point. Next, the instruction interaction sequence is extracted from the communication session layer, and an instruction execution chain is generated by sorting by timestamp. Abnormal jumps in the chain (e.g., "read instruction" directly becomes "firmware write instruction") and repeated execution patterns are identified. Then… The target device type (equipment model, firmware version, and grid level obtained from the power equipment asset database) and attack payload characteristics (including payload encryption method, compression algorithm, and hash value of embedded malicious code fragments) are extracted from the application layer. A dynamic feature importance evaluation mechanism is introduced, and the extracted features are assigned weights (the weights sum to 1) based on the correlation strength between each feature and the attack type in historical attack cases (e.g., the correlation of "abnormal jump in firmware write command" reaches 0.92). Finally, the features are integrated to form a core feature vector containing 128-dimensional feature parameters and corresponding weights. The vector is accompanied by a feature extraction confidence score (reflecting feature completeness, with a minimum of 0.85).

[0104] Preferably, in step 52, an attack feature genealogy library is invoked. This genealogy uses a heterogeneous graph structure to store attack features, where nodes represent attack feature sets (including multi-dimensional features such as protocols, commands, and payloads), and edges represent feature mutation relationships (with the weight being the mutation probability). Feature vectors of all nodes are extracted from the genealogy library, and dimensional similarity calculations are performed with the core feature vectors: for protocol field anomaly patterns, an improved edit distance algorithm (introducing field importance weights, with key field difference weights doubled) is used to calculate text similarity; for command interaction sequences, a dynamic time warping algorithm (allowing time-series scaling matching) is used to calculate temporal similarity; and for target device types, an asset association algorithm (same type) is used. The correlation between device number is 1, and between different models from the same manufacturer, the matching degree is 0.7. The attack payload features are weighted by hash similarity and feature bag-of-words matching degree (weight ratio 6:4). The dimensional similarity is weighted and fused according to the feature weight of the core feature vector (fusion similarity = Σ (dimensional similarity × feature weight)) to generate a comprehensive similarity value between the core feature vector and each lineage node. These values ​​are arranged into an N×1 matrix (N is the total number of lineage nodes) according to the correspondence between "core feature vector - lineage node". The higher the value of the matrix element, the higher the matching degree. This is the required similarity matrix. The matrix is ​​accompanied by the calculation log of the similarity of each dimension for subsequent source tracing results interpretation.

[0105] Optionally, step 53: When the maximum similarity in the similarity matrix exceeds the lineage matching threshold, trace the corresponding attack category node in the attack feature lineage, and determine the attack propagation path by combining the propagation feature library associated with the attack category node, specifically including:

[0106] Step 531: Based on the index value corresponding to the maximum similarity in the similarity matrix, locate the matching attack category node in the attack feature spectrum, extract the attack type identifier, typical attack vector and historical propagation record stored in the node, and generate attack category benchmark information.

[0107] Step 532: Extract propagation feature parameters from the attack category baseline information, retrieve typical propagation ports, device penetration priorities and communication protocol preferences of this type of attack from the propagation feature library associated with the attack category node, and construct a preliminary propagation pattern outline.

[0108] Step 533: Perform time-series correlation processing on the preliminary propagation pattern outline. Dynamically compare the source / destination device sequence and message interaction timing in the determined attack sample with the propagation pattern outline. Use the time-series correlation algorithm to filter out potential propagation chains that conform to the propagation rules.

[0109] Step 534: Perform topology reachability verification on potential propagation chains. Combine the physical topology map of the power industrial control network to verify the actual connection relationship of each device on the link, eliminate false paths that are topologically unreachable, and finally determine the actual propagation path of the attack in the physical network.

[0110] Preferably, in step 531, the index value corresponding to the maximum value is extracted from the similarity matrix. The matching attack category node is located in the node index table of the attack feature spectrum using this index. The node uses a multi-level nested structure to store information. First, the attack type identifier (such as "SQL injection attack") and its associated MITREATT&CK tactical label (such as "lateral movement") are extracted. Then, the typical attack vector of the node is extracted (including the source IP characteristics of the attack, the vulnerability exploit tool signature code used, and the payload format template). Next, the historical propagation records are extracted (including the propagation path, average propagation speed, and distribution of the number of infected devices of 100+ similar attacks). The extracted information is structured and integrated to generate attack category benchmark information containing attack type metadata, attack vector feature library, and propagation statistical parameters. At the same time, the confidence of the benchmark information is calculated (dynamically generated based on the node's hierarchical depth in the spectrum and historical matching accuracy).

[0111] Preferably, in step 532, the attack category baseline information is input into the propagation feature extraction engine, which includes three sub-modules: a protocol analyzer, a device priority evaluator, and a time series modeler. The protocol analyzer identifies the communication protocol used (such as HTTP, Modbus-TCP) from the attack vector of the baseline information, retrieves the typical propagation port list of the corresponding protocol in the propagation feature library (such as 80 / 443 for HTTP, 502 for Modbus), and calculates the usage probability of each port (based on historical attack frequency). The device priority evaluator associates with the power system asset library to evaluate the penetration priority of this type of attack on different devices (such as RTU > SCADA server > smart meter) and generates a device priority vector. The time series modeler analyzes the time interval characteristics in the historical propagation records and constructs a time series model including the attack incubation period, the propagation peak period, and the infection stabilization period. The output results of the three sub-modules are fused to construct a preliminary propagation pattern outline including the protocol port probability distribution, the device penetration priority matrix, and the propagation time series characteristics. This outline includes an uncertainty interval (reflecting the fluctuation range of the propagation characteristics).

[0112] Preferably, in step 533, the preliminary propagation pattern profile is correlated with the source / destination device sequence and message interaction timing of the determined attack sample. First, a sliding time window is constructed (the window size is dynamically adjusted based on the timing characteristics of the propagation pattern profile). Within each window, the matching degree between the device sequence and the device priority matrix in the propagation pattern profile is calculated, and the consistency between the message interaction timing and the propagation timing model is also calculated. A dynamic programming algorithm is used to find the optimal matching path in the timing dimension. This algorithm introduces a time decay factor (higher weight for recent interactions) and a device importance factor (greater penalty for matching errors of critical devices). The generated matching paths are pruned to eliminate paths with timing inconsistencies (such as responses earlier than requests) and logical conflicts (such as direct communication between unauthorized devices). Finally, potential propagation chains that conform to the propagation rules are selected. Each chain contains key parameters such as device jump order, attack time point, and propagation protocol type. At the same time, the confidence score of each chain is calculated (based on timing matching degree and device correlation degree).

[0113] Preferably, in step 534, the potential propagation chain is imported into the topology reachability verification system. This system maintains a real-time physical topology map of the power industrial control network (including device connection relationships, network segmentation information, and security domain boundaries). For each potential propagation chain, the connection relationships between adjacent devices in the chain are extracted, and the existence of physical links or logical channels (such as VPN tunnels) supporting the connection is verified in the topology map. A network access control list (ACL) verification mechanism is introduced to check whether each communication step in the chain complies with the currently effective security policy (such as firewall rules and port access restrictions). For propagation paths across security domains, the existence of authorized trust relationships or trusted proxies is verified. Paths that do not conform to the topology connection relationships or security policies are marked, and all unreachable false paths are eliminated. The attack cost of the retained valid paths is evaluated (based on device protection level and authentication mechanism complexity), and the path with the lowest attack cost is selected as the final determined actual propagation path. The path is accompanied by detailed information such as device jump list, network traversal points, and security policy breach points for subsequent attack tracing, evidence collection, and defense hardening.

[0114] like Figure 2 As shown in the figure, this application embodiment provides a power industrial control flow application layer message anomaly detection device, which includes:

[0115] The data acquisition unit is used to collect all messages from the industrial control network of the power system in real time.

[0116] The filtering unit is used to filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages based on a preset industrial control protocol behavior feature map in order to generate a suspicious traffic event chain.

[0117] The normalization unit is used to perform protocol field normalization processing on suspicious traffic event chains in order to extract cross-level attack feature sets;

[0118] The verification unit is used to input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain a confirmed attack sample whose attack confidence meets the preset standard.

[0119] The attack identification unit is used to determine the attack category and propagation path based on the attack sample by tracing the attack feature spectrum.

[0120] For an exemplary explanation of each unit in the above device embodiments, please refer to the above. Figure 1 Description of the embodiments.

[0121] like Figure 3 As shown, an embodiment of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer-executable program, and the processor runs the computer-executable program to implement the methods described in any of the claims of this application.

[0122] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0123] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting anomalies in power industrial control flow application layer messages, characterized in that, Includes the following steps: Step 1: Real-time acquisition of all packets from the power system's industrial control network; Step 2: Based on the preset industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages to generate suspicious traffic event chains; Step 3: Perform protocol field normalization on the suspicious traffic event chain to extract cross-level attack feature sets; Step 4: Input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets the preset standard. Step 5: Determine the attack category and propagation path based on the attack sample source by using the attack feature spectrum.

2. The method as described in claim 1, characterized in that, Step 1: Real-time collection of all packets from the power system's industrial control network, specifically including: Step 11: Obtain multi-protocol messages collected from key communication links deployed in the power industrial control network; Step 12: Timestamp alignment of multi-protocol messages to build an initial full message database containing message arrival time, protocol type, source / destination address, and payload content; Step 13: Perform integrity verification on the initial full message database, and remove damaged message data during transmission by CRC redundancy check to obtain a valid full message database.

3. The method as described in claim 1, characterized in that, Step 2: Based on a pre-defined industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from normal communication patterns from the full volume of packets in the industrial control network to generate a suspicious traffic event chain, specifically including: Step 21: Calculate the matching degree between each message sequence in the full set of industrial control network messages and the corresponding protocol behavior pattern in the industrial control protocol behavior feature map, so as to generate a behavior deviation quantification value; Step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the deviation quantification value of the packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Step 23: Perform correlation analysis on the marked suspicious traffic segments, merge segments belonging to the same communication session, and form a suspicious traffic event chain.

4. The method as described in claim 1, characterized in that, Step 22: Set a deviation threshold that is dynamically adjusted based on protocol type. When the behavioral deviation quantification of a packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Specifically, this includes: Step 221: Construct a protocol type-threshold mapping table. For different industrial control protocols, initialize their respective baseline deviation thresholds based on the behavioral deviation distribution characteristics of historical normal communication samples. Step 222: Based on the protocol communication load fluctuation coefficient, monitor the communication busyness of each protocol in the current time period corresponding to the message sequence in real time, and dynamically adjust the baseline deviation threshold to obtain the adjusted deviation threshold. Step 223: When the behavior of a message sequence deviates from the quantified value by more than the adjusted deviation threshold, it is marked as a suspicious traffic segment.

5. The method as described in claim 1, characterized in that, Step 3: Perform protocol field normalization on suspicious traffic segments to extract cross-layer attack feature sets, specifically including: Step 31: Build an event chain parsing engine to perform session integrity verification on the suspicious traffic event chain, and associate scattered traffic fragments of the same attack event through session identifiers to form an attack behavior sequence; Step 32: For the attack behavior sequence, use protocol field layered parsing to extract the private fields of different industrial control protocols in a structured manner, and convert the unstructured payload data into quantifiable feature parameters containing field offsets, data types and verification values. Step 33: Based on the temporal position of the fields in the suspicious traffic event chain and their correlation with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the corresponding session initialization stage and command execution stage in the suspicious traffic event chain; Step 34: Map heterogeneous fields from different industrial control protocols to a unified feature space and construct a standardized field matrix that includes the timestamp dimension; Step 35: Based on the standardized field matrix and key fields, perform cross-event chain feature extraction to generate a cross-level attack feature set, which includes protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

6. The method as described in claim 1, characterized in that, Step 4: Input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets the preset standard, specifically including: Step 41: Perform feature dimension verification on the cross-level attack feature set, use principal component analysis combined with maximum information coefficient to screen core features, remove redundant features, and at the same time perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set; Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set. Step 43: Initiate a three-round progressive verification mechanism. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. The comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

7. The method as described in claim 1, characterized in that, Step 5: Determine the attack category and propagation path based on the attack sample source by analyzing the attack feature spectrum. This includes: Step 51: Extract the core feature vector of the identified attack sample, including abnormal patterns of protocol fields, command interaction sequences, target device type, and attack payload characteristics; Step 52: Calculate the similarity matrix between the core feature vector and the features of each node in the attack feature spectrum; Step 53: When the maximum similarity in the similarity matrix exceeds the spectrum matching threshold, trace the corresponding attack category node in the attack feature spectrum, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

8. The method as described in claim 7, characterized in that, Step 53: When the maximum similarity in the similarity matrix exceeds the lineage matching threshold, trace the corresponding attack category node in the attack feature lineage, and determine the attack propagation path by combining the propagation feature library associated with the attack category node. Specifically, this includes: Step 531: Based on the index value corresponding to the maximum similarity in the similarity matrix, locate the matching attack category node in the attack feature spectrum, extract the attack type identifier, typical attack vector and historical propagation record stored in the node, and generate attack category benchmark information. Step 532: Extract propagation feature parameters from the attack category baseline information, retrieve typical propagation ports, device penetration priorities and communication protocol preferences of this type of attack from the propagation feature library associated with the attack category nodes, and construct a preliminary propagation pattern outline. Step 533: Perform time-series correlation processing on the preliminary propagation pattern outline. Dynamically compare the source / destination device sequence and message interaction timing in the determined attack sample with the propagation pattern outline. Use the time-series correlation algorithm to filter out potential propagation chains that conform to the propagation rules. Step 534: Perform topology reachability verification on potential propagation chains. Combine the physical topology map of the power industrial control network to verify the actual connection relationship of each device on the link, eliminate false paths that are topologically unreachable, and finally determine the actual propagation path of the attack in the physical network.

9. A device for detecting abnormal messages in the power industrial control flow application layer, characterized in that, include: The data acquisition unit is used to collect all messages from the industrial control network of the power system in real time. The filtering unit is used to filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages based on a preset industrial control protocol behavior feature map in order to generate a suspicious traffic event chain. The normalization unit is used to perform protocol field normalization processing on suspicious traffic event chains in order to extract cross-level attack feature sets; The verification unit is used to input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain a confirmed attack sample whose attack confidence meets the preset standard. The attack identification unit is used to determine the attack category and propagation path based on the attack sample by tracing the attack feature spectrum.

10. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer-executable program, and the processor runs the computer-executable program to implement the method of any one of claims 1-8.

Images