Method for detecting unknown network attack of terminal of power internet of things based on hypergraph

Abstract

The invention discloses a hypergraph-based unknown network attack detection method for an electric power Internet of Things terminal, relates to the technical field of network attack detection, and solves the problems of insufficient model expression ability, overfitting and learning set deviation caused by the fact that a model method in the prior art ensures that known classes are fully separated and unknown classes are far away from the centers of the known classes. According to the method, dual modeling capabilities of a graph structure and a time sequence structure are combined, so that the method can effectively adapt to complex distribution characteristics in a dynamic electric power Internet of Things environment, and is particularly suitable for the problems of non-uniformity, burstiness, unknown traffic characteristic change and the like in an electric power Internet of Things terminal data stream; and the adaptability of the model to the diversified data structure of the edge device is improved. A dimension compression mechanism is introduced in the structural design of the model, the parameter quantity of the model is effectively reduced, lightweight deployment and end-side reasoning on an edge node or an industrial terminal are ensured, and therefore the real-time attack detection capacity of the power system is improved.

Description

Technical Field

[0001] This invention relates to the field of network attack detection technology, and in particular to a method for detecting unknown network attacks on power Internet of Things (IoT) terminals based on hypergraphs. Background Technology

[0002] With the continuous advancement of power grid digitalization and intelligentization, the Power Internet of Things (Power IoT), as a key supporting technology for the next-generation smart grid, is rapidly developing and being widely applied in power systems. Power IoT, through the deployment of numerous distributed terminal devices, enables real-time data collection, transmission, and intelligent analysis of power infrastructure, facilitating refined management and intelligent decision-making within the power grid. However, Power IoT terminals typically exhibit characteristics such as dense deployment, blurred network boundaries, and inconsistent access standards, making them prime targets for cyberattacks. Once these terminal devices are attacked, it can lead to serious consequences such as information leakage, control anomalies, and system paralysis, directly threatening the operational security of the power system. Therefore, constructing an efficient and real-time intrusion detection mechanism has become a critical technical requirement for ensuring the secure operation of the Power IoT.

[0003] In recent years, graph learning-based network attack and intrusion detection methods have attracted widespread attention due to their potential in modeling complex relationships and improving detection accuracy. By constructing network traffic data into graph structures, especially hierarchical graph structures, the potential correlations between traffic can be effectively mined, thereby improving the ability to identify maliciously tampered or mutated traffic. However, traditional graph structures can only express binary relationships (such as connections between node pairs), and their expressive power is insufficient when dealing with the large number of unpaired and multi-dimensional interaction relationships in complex systems such as the power Internet of Things. At the same time, simple classification methods based on softmax results are difficult to effectively distinguish unknown types, and therefore cannot effectively deal with the detection of unknown attacks. Existing models mostly use CNN / LSTM to extract traffic sequence features, lacking the ability to model the multi-dimensional interaction structure between entities. In particular, their ability to understand high-order traffic relationships is limited. Graph Neural Networks (GNNs) mainly rely on the connection relationships (edges) between nodes for information transmission and learning, but in some tasks, the edges themselves also carry important information (such as transmission patterns between traffic, timestamps, and other attributes). If the attributes of the edges are not considered, the model may ignore this key information, leading to performance degradation. Compared to ordinary graph structures, hypergraphs can better represent higher-order relationships between complex entities through hyperedges. Currently, when researchers use hypergraph structures to analyze traffic data, they often construct hypergraphs based on port numbers or distances between traffic data points. However, a single hypergraph structure suffers some loss in global feature analysis.

[0004] As cyberattacks become increasingly sophisticated, traditional models trained only on known attacks show a significant decline in detection performance when faced with constantly evolving unknown attack samples. This is particularly true in critical infrastructure such as the power IoT, where missing any unknown attack can have serious consequences. Real-world network environments are characterized by a wide variety of attack types and frequent emergence of new attacks. Test sets may contain attack samples never seen during training, leading to the "open set identification" problem—how to effectively reject unknown classes when trained only on known classes. Furthermore, most existing models tend to focus on modeling known classes during training, neglecting open set constraints, resulting in poor generalization.

[0005] Current mainstream methods for detecting unknown attacks include emergency reclassification methods (such as backend re-identification mechanisms), anomaly analysis based on feature distribution, and open set detection models based on extreme value theory. However, most of these methods are based on graph neural networks (GNNs) or planar networks. These models rely on a single graph or a single temporal feature, neglecting edge attributes in the graph structure and the interaction between temporal and structural elements. Their feature representation lacks discriminative power, failing to guarantee sufficient separation between known classes and that unknown classes are far from the centers of known classes. This results in insufficient model expressive power and problems such as overfitting and biased learning sets. Some studies have attempted unknown class detection models for specific scenarios, but these models suffer from insufficient generalization due to limitations imposed by the application domain.

[0006] Therefore, a method for detecting unknown network attacks on power IoT terminals based on hypergraphs is needed. Summary of the Invention

[0007] To address the shortcomings of existing technologies that rely on single graphs or single temporal features, neglecting edge attributes and the interaction between temporal and structural aspects, resulting in insufficient discriminative feature representation, inability to guarantee sufficient separation between known classes and that unknown classes are far from the centers of known classes, leading to insufficient model expressive power and problems such as overfitting and biased learning sets, this invention provides a hypergraph-based method for detecting unknown network attacks on power IoT terminals. This method combines the dual modeling capabilities of graph and temporal structures, effectively adapting to the complex distribution characteristics of dynamic power IoT environments. Furthermore, the model incorporates dimensionality compression mechanisms (such as dimensionality reduction layers and gated fusion) in its structural design, effectively reducing the number of model parameters and ensuring lightweight deployment and edge-side inference on edge nodes or industrial terminals, thereby improving the real-time attack detection capability of power systems. The specific technical solution is as follows: A method for detecting unknown network attacks on power IoT terminals based on hypergraphs includes the following steps: Network traffic data is collected, and hypergraph structures from different perspectives are constructed. A unified high-order hyperedge connection matrix is ​​generated through a fusion strategy. Then, dynamic weighted fusion is performed on the hyperedge connection matrices from each perspective to generate the final unified fused hypergraph structure. The temporal hidden state vector of the obtained network traffic attack sample is extracted and mapped to a fixed-length representation of uniform dimension; Different feature fusion weights are dynamically assigned at different task stages, and cross-entropy loss, Center Loss, OpenMax rejection loss, and information entropy regularization term are introduced into the loss function. The rejection probability is calculated by matching the sample with a pre-trained Weibull distribution. When the rejection probability is higher than a set threshold, the sample is judged as an unknown attack.

[0008] Preferably, constructing hypergraph structures from different perspectives includes constructing hyperedges based on feature space similarity, constructing hyperedges based on protocol fields, and constructing hyperedges based on port usage patterns.

[0009] Preferably, the steps for generating the final unified fused hypergraph structure are as follows: Assign learnable weight coefficients to each viewpoint Satisfies the normalization constraint: Next, the hyperedge connection matrices from each perspective are integrated using a weighted summation method to form the fused result: in Dynamic weights Learning through data-driven gated neural networks; This multi-view fusion mechanism ultimately generates the fused hyperedge connectivity matrix. ,in The number of valid hyperedges retained after all perspectives are merged. The matrix has N rows × A column whose elements are real numbers; The merged hypergraph structure is represented as follows: .

[0010] Preferably, different feature fusion weights are dynamically allocated at different task stages to jointly model the structural features extracted by the graph neural network and the temporal features extracted by the bidirectional long short-term memory network. Specifically, the fusion weights of each channel feature are learned through a sigmoid-activated gating function to achieve selective information fusion, as shown below: in, Represents the weights of the fully connected layer. For the output of BiLSTM, For graph features, This represents the activation function.

[0011] Preferably, the loss function is expressed as follows: in, Represented as the cross-entropy loss of known classes, Penalty term for sample uncertainty For open space constraints, Loss at the center , , , These are the hyperparameters for the weights of each loss term.

[0012] Preferably, the steps for determining an unknown attack are as follows: By aggregating the feature vectors of each known sample in the training set, the feature center of each category is calculated. Select the farthest values ​​from the distances of each sample to its corresponding class center to form the tail set; After obtaining the tail distance, the tail distance of each class is fitted with a Weibull distribution using methods such as maximum likelihood estimation to obtain the scale parameters and shape parameters corresponding to each class. During the verification or testing phase, features are extracted from the test samples. Calculate its distance from the center of each category. It can be represented as: The tail cumulative distribution function of this distance is calculated using the Weibull distribution fitted during the training phase, thus obtaining the rejection probability. : Based on the rejection probability For each category, logits are recalibrated (OpenMax), and the recalibrated scores are... and confidence level of unknown classes The calculation formula is expressed as follows: Among them, It is the logit value before the original Softmax, which is the original score of the classifier's last layer for that class. This is the score after recalibration. Confidence level for the unknown class; The model makes a final decision based on the confidence scores of each category and the unknown category. When the score of the unknown category is the highest or exceeds the set threshold, the sample is judged as an unknown attack; otherwise, it is classified into the corresponding known category.

[0013] Preferably, before extracting the temporal hidden state vector of the network traffic attack sample, the multi-dimensional relationship features between devices are aggregated through the established hypergraph structure, and the OpenMax mechanism is used to isolate potential unknown attack samples in advance in the feature space.

[0014] Preferably, the specific steps for using the OpenMax mechanism to isolate potential unknown attack samples in advance in the feature space are as follows: By modeling the higher-order relationships between device samples through hypergraph structure modeling, we can obtain context-aware structural feature representations, construct a hypergraph and perform node feature aggregation, input the original feature vector, construct a set of hyperedges based on multi-view relationships, and form a hypergraph association matrix that reflects the higher-order structural relationships between samples. The original features are aggregated into structural embedding features using a hypergraph structure, as shown in the following formula: in Represents the original feature matrix, For trainable parameter weights, For activation function, This is the node-hyperedge connection matrix. It is the hypermarginality matrix. Let the node degree matrix be... This is the hyperedge weight matrix. The output is structure-aware features; For aggregation results Perform one layer of ReLU activation, and the result is still denoted as... , dimension For each known class in the training set Calculate its feature centers The formula is as follows: Where S k This indicates that it belongs to category c. k The set of all training samples; Based on OpenMax, an unknown class rejection decision is performed. Potential unknown attack samples are detected in advance in the feature space and rejected. Then, for each sample... The formula for calculating the Euclidean distance to each type of center is: Potentially unknown attack samples are detected in advance in the feature space and rejected. A Weibull distribution is fitted, and the distance set for each known class is calculated. By fitting a Weibull distribution, we obtain an estimate of the tail distribution for each class. The probability of a sample being rejected as an unknown class is calculated using the distance and the fitted distribution: CDFWeibull k Let represent the cumulative distribution function of the Weibull distribution fitted for the k-th known class; like If the threshold τ is exceeded, the sample is classified as an unknown attack class; otherwise, the known class corresponding to the highest confidence level is retained as the prediction result.

[0015] A computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the above-described method for detecting unknown network attacks on power Internet of Things terminals based on a hypergraph.

[0016] A processor for running a program, wherein the program executes the supergraph-based method for detecting unknown network attacks on power Internet of Things (IoT) terminals as described above.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention significantly enhances the model's ability to discriminate against unknown attacks by combining the OpenMax open-set inference mechanism and the Weibull tail modeling strategy. It improves the model's ability to reject unknown class samples during the validation phase, effectively avoiding misclassification of unknown attacks as known classes, thus enhancing the model's security protection capabilities in real-world environments. Furthermore, the improved network structure introduces a center loss mechanism and entropy regularization term on top of LSTM and graph convolution. This not only effectively compresses intra-class feature distribution but also improves inter-class discriminative power, achieving a more compact clustering distribution in low-dimensional visualization (such as t-SNE) space, further enhancing the model's discriminative reliability. Moreover, this invention combines the dual modeling capabilities of graph and temporal structures, effectively adapting to the complex distribution characteristics in dynamic power IoT environments. It is particularly suitable for addressing issues such as unevenness, suddenness, and unknown flow characteristic changes in power IoT terminal data streams, improving the model's adaptability to diverse data structures of edge devices. The model incorporates dimensionality compression mechanisms (such as dimensionality reduction layers and gated fusion) in its structural design, effectively reducing the number of model parameters and ensuring lightweight deployment and edge inference on edge nodes or industrial terminals, thereby improving the real-time attack detection capability of power systems. In summary, this invention has significant advantages in model structure innovation, algorithm robustness, detection accuracy, and deployment flexibility. It effectively addresses the shortcomings of existing power IoT intrusion detection technologies in the face of unknown attacks and high-dimensional data stream scenarios, possessing broad engineering practical value and industrial promotion potential. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0019] Figure 1 A schematic diagram of hypergraph evolution under the multi-view hyperedge fusion mechanism; Figure 2 This is a diagram illustrating the confidence distribution of unknown attacks. Figure 3 This is a diagram illustrating how model performance changes with training epochs. Figure 4 A diagram showing the comparison of accuracy in identifying different attacks; Figure 5 Confusion matrix diagram for experimental results; Figure 6 The flowchart shows a method for detecting unknown network attacks on power IoT terminals based on hypergraph temporal hybrid modeling. Figure 7 This is a diagram of the overall network architecture. Figure 8 This is a schematic diagram of a hybrid open set loss function; Figure 9 This is a schematic diagram of the post-processing mechanisms of OpenMax and Weibull; Figure 10 This is a flowchart of the overall process of the method of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] In one embodiment of the present invention, a method for detecting unknown network attacks on power Internet of Things (IoT) terminals based on hypergraphs is provided, such as... Figure 10 , Figure 7 As shown, it includes the following steps: 1. A Hypergraph Modeling Method Based on Multi-View Hyperedge Fusion To address the challenges of network intrusion detection, such as the significant differences in the distribution of various attack behaviors, severe overlap in feature spaces, and the difficulty of traditional graph modeling methods in capturing high-order semantic relationships, this invention proposes a multi-perspective hyperedge fusion hypergraph modeling method. This method, starting from multi-dimensional features, designs hyperedge construction strategies based on multiple perspectives, including protocol type, port distribution, and traffic feature similarity, to characterize the high-order correlations between network traffic samples. To enhance the complementarity of semantic information from different perspectives and the consistency of overall modeling, a hyperedge fusion strategy based on gated weighted aggregation is further introduced. This strategy adaptively learns the contribution weights of different perspectives in different traffic scenarios, constructing a unified fused hyperedge connection matrix. While preserving the original traffic semantics, this method effectively enhances the expressiveness and generalization ability of the graph structure, providing a robust, high-dimensional, and highly expressive structural foundation for downstream hypergraph neural network encoding and open-class attack detection. Figure 6 As shown.

[0025] 1.1 Multi-stage preprocessing method for network traffic data Raw network traffic data typically contains a large amount of unstructured, missing, inconsistent, or non-numerical information. Directly using it for modeling can lead to difficulties in model convergence, uneven dimensionality, and abnormal feature distribution, severely impacting the accuracy and robustness of downstream hypergraph modeling. Therefore, before constructing a multi-view hypergraph structure, network traffic data must undergo systematic multi-stage preprocessing to improve data quality and feature consistency. This invention employs a three-stage preprocessing process, including data cleaning, data standardization, and data normalization. This method removes invalid information, unifies feature formats, and compresses feature scale differences, thereby effectively improving the usability of network traffic data and laying the foundation for constructing a hypergraph structure with high-order semantic relationships.

[0026] Step 1: Data Cleaning. As the primary preprocessing step in attack analysis, traffic data cleaning's main function is to remove missing values, invalid fields, and abnormal records from the raw data, ensuring data integrity and accuracy. This involves scanning each piece of raw network traffic data to remove data items containing null values, those with incorrect formats (such as non-standard IP field representations), duplicate records, or those with abnormal values ​​(such as TTL values ​​exceeding the theoretical range). This article uses a structured traffic sample from CICIDS2017 as an example to demonstrate a standardized data cleaning process.

[0027] Because the original stream contains redundant and lengthy identifier fields (such as Flow ID, Source / Destination IP, Timestamp, etc.), this information cannot be directly used for generalization prediction during the modeling stage. Therefore, the first step is to remove non-learnable fields and retain only numerical / categorical fields that are strongly correlated with the attack behavior, such as: Numeric fields: Flow Duration, Total Fwd / Bwd Packets, Flow Bytes / s, Fwd IATMean, etc. Category fields: Label, knowLabel, Protocol, etc.

[0028] At the same time, the text category field will be uniformly encoded. For example: Protocol fields (such as TCP / UDP / ICMP) are uniformly mapped to integer types; The original attack type in the Label field (such as Heartbleed, bot, dos, etc.) is uniformly mapped to the corresponding category ID, for example, Heartbleed corresponds to 1, bot corresponds to 2, dos corresponds to 3, etc.

[0029] The new knowLabel label is added, and known traffic types are marked as Known (Category ID is 0), normal traffic types are marked as Normal (Category ID is 1), and unknown traffic types are marked as Unknown (Category ID is 2).

[0030] Step 2: Data Encoding & Formatting. This step converts the cleaned structured network traffic samples into a numerical input format that the model can directly accept. This ensures consistency, stability, and comparability of different types of fields in the vector space, thereby improving the performance of downstream feature modeling and classifiers. Data standardization mainly includes three sub-steps: category field encoding, mapping of special semantic fields, and standardization of format.

[0031] (1) Category field encoding (One-hot encoding) For discrete feature fields (such as Protocol, Flag, Connection_State, etc.) in the original data, direct numerical mapping may lead to pseudo-order relationships. Therefore, a one-hot encoding strategy is used to convert them into sparse vectors. For example: Protocol = TCP → [1, 0, 0] (corresponding to TCP / UDP / ICMP protocols); Flag = SF → [0, 1, 0, 0, 0, 0, 0] (corresponding to 7 enumeration values ​​for the Flag field).

[0032] To prevent dimensionality explosion, this paper retains the top k most frequent categories and merges low-frequency categories into a unified OTHER category node.

[0033] (2) Special field semantic mapping (Rule-based Mapping) Raw structured traffic data contains several numeric fields with special semantics, such as port number (Src Port / Dst Port), timestamp, and flow duration. Directly using these fields as continuous variables might introduce meaningless biases. Therefore, semantically driven mapping rules are introduced: Port number encoding: Mapping ports to semantic categories according to their functional range. 0–1023 → SYSTEM_PORT 1024–49151 → USER_PORT 49152–65535 → DYNAMIC_PORT is then converted into vector form via one-hot encoding.

[0034] Timestamp encoding: Extracting standardized time features, such as: Time period information (morning / afternoon / late night) What day of the week (weekday / weekend)? Is it during working hours (e.g., 9:00–17:00)? They are uniformly converted into structured Boolean / numerical vectors.

[0035] IP address and MAC address handling: These fields cannot be used directly after being anonymized; they must be replaced with placeholders. <ip>Alternatively, a hash indicator can be used to preserve communication structure information but mask the specific entity.

[0036] (3) Formatting specifications and placeholder reconstruction To improve the standardization of data input and the generalization ability of the model, the following format standardization process is performed on all samples: Field order alignment: All feature fields are arranged in a fixed order to ensure consistency of model input dimensions; Placeholder reconstruction: For de-identified fields such as <timestamp> 、 <ip> 、 <port>Introducing uniform format tags to prevent specific numerical patterns from overfitting the training; Numerical padding specification: all missing fields are uniformly completed as a full 0 vector or a placeholder vector [0,...,0] to facilitate batched tensor input.

[0037] Standardization example Take an original structured sample as an example, part of its fields are as follows: Finally, the input form of the sample after standardization is a sparse vector x, which is directly accessed by the hypergraph modeling module: x=[1,0,0,1,0,0,0,0,1,0,1,1,0.57,..., the rest of the fields] Step 3: Data normalization (Feature Normalization) This step can perform uniform normalization processing on numerical feature fields in structured samples, compress the differences of different features in numerical scale, eliminate the feature weight deviation problem caused by inconsistent dimensions, and improve the model convergence efficiency, feature discrimination ability and high-order structure modeling effect. Normalization operation preserves the relative numerical relationship while making each dimension feature have a unified scale basis, which is more suitable for subsequent construction of hypergraph edge weight and adjacency relationship tensor.

[0038] (1) Normalization strategy selection: Min-Max Normalization Considering that most numerical features in the data set have a wide range of values and do not show a clear centralized distribution, this paper adopts the Min-Max Normalization method to linearly compress all continuous numerical fields to a fixed interval [0,1][0, 1][0,1]: Where represents the value of a single data, is the minimum value of all data in the column where the data is located, is the maximum value of all data in the column where the data is located. The normalized data reduces the weight imbalance caused by sample differences, which is more conducive to the construction of hypergraph structure.

[0039] (2) Normalization field range Normalization operation covers all non-category continuous numerical fields, including but not limited to: Network statistical features: such as Flow Duration, Total Fwd Packets, Packet Length Mean; Latency and rate fields: such as Flow IAT Mean, Fwd Packet Length Max, Flow Bytes / s; Intensity indicators: such as Active Mean, Idle Std, Init_Win_bytes_forward.

[0040] At the same time, for pseudo numerical fields (such as port numbers), normalization can also be performed in the scene without semantic mapping to maintain the consistency of the overall input.

[0041] (3) Normalization example Take the Dst Port field as an example, its theoretical value range is [1, 65535][1, 65535][1, 65535]. If the value of this field in the original sample is 80, the normalization result is calculated as follows: Similarly, if Flow Duration is 1830000 and the maximum value of the column is 10000000 and the minimum value is 0, then after normalization: 1.2 Multi-view hyperedge construction and fusion mechanism In traditional graph neural network modeling, the graph structure can usually only represent binary relationships, and it is difficult to model the multi-dimensional, multi-granularity, high-order semantic interaction features in network traffic samples, such as shared ports, protocol similarity, or communication mode structure. Such low-order graph structures have limited expressive ability when facing complex attack patterns (such as DDoS, slow scanning, multi-step attacks), resulting in low model recognition accuracy and poor generalization ability. To solve the above problems, the present application proposes a multi-view based hyperedge construction and fusion mechanism. This mechanism supports the construction of hypergraph structures under different perspectives from multiple feature dimensions (such as feature space similarity, protocol field, and port mode), and generates a unified high-order hyperedge connection matrix through a fusion strategy to enhance the modeling ability of the implicit relationships between traffic samples.

[0042] The preprocessed network traffic sample set is represented as: wherein, is the i-th sample, with a dimension of d, and the total number of samples is N. Each sample contains normalized numerical features.

[0043] Step 1: Multi-view Hyperedge Construction. To more comprehensively capture the high-order semantic relationships between network traffic samples, this paper proposes a multi-view hyperedge construction method. Hyperedge sets are constructed from three perspectives: feature similarity, protocol type, and port pattern. Finally, a unified fused hyperedge connection matrix is ​​generated through a gating fusion mechanism. This strategy helps to explicitly express the relationships between traffic samples in different semantic spaces and improves the ability of hypergraph neural networks to model complex behavioral patterns.

[0044] (1) Construction of hyperedges based on feature space similarity (perspective 1) From a feature perspective, semantic similarity between samples is represented by their structured feature vectors, and neighborhood relationships are constructed based on feature distance. First, cosine similarity between samples is calculated for all normalized numerical features. For each sample, the top features in its feature space are selected... For each nearest neighbor sample, a local feature similarity hyperedge is constructed. The set of hyperedges from a feature perspective is constructed in this way: And generate the corresponding hyperedge connection matrix. Hypergraph Structure G (1) It is a graph structure, where V represents a vertex and E... (1) Represents an edge. Used to characterize higher-order relationships between samples based on feature similarity.

[0045] (2) Construction of hyperedges based on protocol fields (perspective 2) Protocol fields are important semantic labels reflecting network behavioral intentions. From this perspective, protocol class hyperedges are constructed using protocol fields as the dividing criterion. Samples with the same protocol identifier (e.g., TCP, UDP, ICMP, MODBUS, etc.) are grouped together, and each protocol group constitutes a semantic hyperedge, representing the commonalities of interaction within that protocol type. The set of hyperedges from a protocol perspective is constructed as follows: This then generates the hyperedge connection matrix. Hypergraph Structure , explicitly express higher-order topological relationships under protocol consistency.

[0046] (3) Construction of hyperedges based on port usage patterns (perspective 3) Port patterns often implicitly contain behavioral characteristics such as service categories and communication roles. From this perspective, service class hyperedges are constructed based on port usage characteristics. First, the source / destination port number field is extracted, and the port usage distribution is statistically analyzed. Then, port pattern categories are divided according to communication roles or port ranges (e.g., [0-1024] represents system ports, >49152 represents dynamic ports). Each type of port pattern sample constitutes a hyperedge from a port perspective: Construct the corresponding hyperedge connection matrix Hypergraph Structure To capture the structural commonalities of service behaviors among traffic samples.

[0047] Step 2: Multi-view Hypergraph Fusion To integrate structural information from different perspectives, this paper introduces a data-driven gated neural network fusion mechanism. This mechanism dynamically weights and fuses the hyperedge connection matrices from each perspective to generate the final unified fused hypergraph structure. First, learnable weight coefficients are assigned to each viewpoint. Satisfies the normalization constraint: Next, the hyperedge connection matrices from each perspective are integrated using a weighted summation method to form the fused result: in Dynamic weights It can learn through data-driven gated neural networks.

[0048] This multi-view fusion mechanism ultimately generates the fused hyperedge connectivity matrix. ,in The number of valid hyperedges retained after all perspectives are merged. The matrix has N rows × A column whose elements are real numbers. The merged hypergraph structure is represented as follows: Finally, the merged hyperedge connection matrix and the preprocessed network traffic sample set and hypergraph structure It will be used as input to the subsequent hypergraph neural network encoding module.

[0049] 2. A Network Attack Feature Extraction Method Based on Hypergraph Temporal Hybrid Modeling To address the major bottlenecks in attack detection of power IoT terminals, such as the lack of high-order multi-relation modeling, spatiotemporal feature decoupling, and interference from unknown samples, this paper designs a network attack feature extraction method based on hypergraph temporal hybrid modeling. This method primarily captures high-order relationship structures and features (e.g., commonalities among multiple network behaviors and communication pairs of power IoT terminals) and transforms them into effective node embeddings (i.e., semantic features of attack behavior), extracting discriminative features to distinguish between normal, known, and unknown attacks. First, a hyperedge adaptive aggregation mechanism is designed to dynamically fuse topology / protocol / behavioral multi-relationships, accurately capturing collaborative attack patterns of power equipment groups and solving the challenge of multi-relationship interaction modeling. Then, an HGCN-BiLSTM cascaded model is constructed to extract temporal features of attack sequences, modeling the temporal context of the attack chain (forward propagation path + backward causal tracing) to achieve full-process tracking of attack evolution. Finally, a ReLU-based spatiotemporal feature model is designed to facilitate dimensionality reduction, enhance intra-class compactness, expand the decision boundaries of known / unknown classes, and improve the generalization ability of open sets, such as... Figure 7 As shown.

[0050] Step 1: Hypergraph-based Node Feature Aggregation and Unknown Class Rejection. By aggregating multi-dimensional relationship features between devices through the established hypergraph structure, and utilizing the OpenMax mechanism to pre-isolate potential unknown attack samples in the feature space, a purified feature representation is provided for subsequent processing. This achieves high-order relationship modeling, captures non-paired collaborative relationships between power terminal devices (such as multi-device collaborative DDoS attacks), performs unknown attack pre-filtering, and identifies and suppresses anomalous samples far from known class centers at the feature layer. Simultaneously, anti-pollution protection is implemented to prevent unknown samples from distorting the distribution of known attack features. First, the high-order associations between device samples are modeled through the hypergraph structure to obtain context-aware structural feature representations. A hypergraph is then constructed and node feature aggregation is performed, with the original feature vector as input. (d-dimensional vector, the original feature vector of a single sample (e.g., the features of a power device).) A hyperedge set is constructed based on multi-perspective relationships, forming a hypergraph association matrix that reflects the higher-order structural relationships between samples. Then, the hypergraph structure is used to represent the original features... (The original feature matrix of all samples, where N is the number of samples and d is the feature dimension.) Aggregated into structural embedding features. (The aggregated structural feature matrix, where d' is the transformed feature dimension), is calculated as follows: in This represents the original feature matrix (input). These are trainable parameter weights (linear mappings). For activation functions (such as ReLU). This is the node-hyperedge connection matrix. It is the hypermarginality matrix. Let the node degree matrix be... This is the hyperedge weight matrix. The output is structure-aware features (embeddings).

[0051] Secondly, to enhance the expressive power of structural embedding features and provide a discriminative space for subsequent classification and rejection, nonlinear feature transformation and feature space mapping are performed. First, the aggregation results are... Perform a ReLU activation layer to increase nonlinear modeling capability; the result is still denoted as... , dimension This is the semantic representation of the graph structure corresponding to each sample. For each known category in the training set... Calculate its feature centers The formula is as follows: Where S k This indicates that it belongs to category c. k The set of all training samples.

[0052] These centers will be used to measure the distance relationship between new samples and known classes.

[0053] Finally, based on OpenMax, an unknown class rejection decision is made to detect potential unknown attack samples in advance in the feature space and reject them. Then, for each sample... The formula for calculating the Euclidean distance to each type of center is: , Finally, potential unknown attack samples are detected in advance in the feature space and rejected. A Weibull distribution is fitted (during the training phase), and the distance set for each known class is calculated. Fit a Weibull distribution to obtain the tail distribution estimate for each class. The probability of a sample being rejected as an unknown class is calculated using the distance and the fitted distribution: CDFWeibull k Let represent the cumulative distribution function of the Weibull distribution fitted for the k-th known class.

[0054] like If the threshold τ is exceeded, the sample is classified as an unknown attack class; otherwise, the known class corresponding to the highest confidence level is retained as the prediction result.

[0055] in To input the original feature matrix, The feature representation after graph aggregation, It is the hypergraph incidence matrix. For the node / hyperedge degree matrix, The feature mapping weight matrix, It is the first Class feature center, For the sample and the first Class center distance, This represents the probability of being classified as an unknown class.

[0056] Step 2: Temporal Feature Extraction of Attack Sequences Based on BiLSTM. This step aims to perform temporal extension modeling on the features of the attack samples after graph aggregation to characterize the evolution of attack behavior in network traffic. Assuming that the Hypergraph Neural Network (HGNN) in the previous stage has generated node-level embedding vectors for each sample, the formula is as follows: , Where, T: total sequence length (fixed value), t: index of a specific time step (t∈{1,2,…,T}), d: dimension of the node embedding feature, each This represents the feature representation of a node at a certain time. Indicates the sequence length.

[0057] In order to The modeling of the temporal dependencies before and after is performed using a bidirectional LSTM (BiLSTM) for encoding, the structure of which can be defined as a forward LSTM and a backward LSTM respectively: , , in For a moment The bidirectional hidden state representation, The hidden dimension of a unidirectional LSTM. This is the hidden state of the forward LSTM. It is the hidden state of the inverse LSTM.

[0058] To obtain the global semantic embedding features of the entire time series process, the hidden state vector of the final time step is extracted (which can be concatenated with the forward final time step and the reverse starting time step): This represents the global feature representation at the final time step. The hidden state of the forward LSTM at the last time step T (contextual features at the end of the sequence). The hidden state of the inverse LSTM at the start time step 1 (the inverse context at the beginning of the sequence). Total dimensions after bidirectional stitching ( and (Assembling). Batch size.

[0059] Step 3: Feature Dimensionality Reduction to Eliminate Redundant Information in Spatiotemporal Features. This step aims to map (or compress) the temporal hidden state vector of the network traffic attack sample extracted by Bidirectional LSTM (BiLSTM) into a fixed-length representation of uniform dimension, so that subsequent modules can perform unified classification or feature fusion. Let BiLSTM perform temporal modeling on the feature sequence after graph aggregation, obtaining the bidirectional hidden state formula at each time step: The hidden state at the final time step T is selected as the overall temporal representation of the sample: The hidden dimension of a unidirectional LSTM. Total dimensions after bidirectional stitching ( and (Assembling).

[0060] Finally, there's the dimensionality reduction operation, for... Perform dimensionality reduction and map to a unified dimension. This yields the final unified feature representation vector: in For the dimension reduction weight matrix, It is a bias vector. It is the output dimensionality-reduced feature vector, which is used as input to subsequent classifiers or fusion modules. This represents the activation function.

[0061] 3. A Design Method for a Dual Regularized Joint Loss Function for Unknown Attack Detection In unknown attack detection tasks, models need to not only accurately identify known attack types that appeared during the training phase, but also have the ability to reject unseen attack types (unknown classes). However, existing methods generally rely on supervised learning of known class features, and their models face two key challenges in open environments: First, unknown and known classes often overlap significantly in the feature space, resulting in severe aliasing of class features and a high risk of unknown classes being misclassified as known classes; second, since unknown classes do not participate in training, their class boundaries are difficult to model accurately, leading to highly ambiguous discrimination regions. Furthermore, in scenarios where structural and temporal information coexist, traditional methods often employ simple concatenation or weighting strategies for feature fusion, lacking dynamic modeling of the contribution of different information channels at different stages of the task, further resulting in poor feature fusion performance and severely limiting the model's ability to identify open sets, such as... Figure 8 As shown.

[0062] To address this, this invention designs a dynamic integration strategy for structure-temporal features based on a fusion gate mechanism. This mechanism integrates structural features extracted by High Graph Hypernetics Network (HGNN) and temporal features extracted by Bidirectional Long Short-Term Memory Network (BiLSTM). By introducing an adaptive gating network, it dynamically allocates the fusion weights of the two types of features at different task stages, effectively alleviating the feature imbalance problem and improving the model's discriminative performance. Simultaneously, this patent proposes an innovative OpenSetCenterHybridLoss loss function. Unlike traditional concatenated loss integration methods, this loss function integrates cross-entropy loss, Center Loss, OpenMax open-set rejection loss, and information entropy regularization. It also introduces a learnable margin optimization strategy based on class centers to dynamically adjust the minimum boundary distance between classes, enhancing the model's robustness against unknown classes from a mechanism perspective. These methods not only strengthen the clustering effect of known classes but also significantly improve the model's discriminativeness, interpretability, and generalization ability in open-set environments.

[0063] Step 1: Gated Fusion Mechanism Design. A gated fusion mechanism is a dynamic weighting method for integrating multimodal or multi-channel features, designed to automatically adjust the contribution of various features based on different inputs or task stages. In this invention, the gated fusion mechanism introduces an adaptive gated network to jointly model the structural features extracted by a Graph Neural Network (HGNN) and the temporal features extracted by a Bidirectional Long Short-Term Memory Network (BiLSTM). Specifically, this mechanism learns the fusion weights of each channel feature through a sigmoid-activated gate function, achieving selective information fusion. Its essential advantage lies in its ability to dynamically control the dominance of different features in the fusion process based on sample differences and contextual requirements, thereby improving the overall discriminative power and generalization performance of the feature representation. The gated fusion mechanism can be expressed as: in, This represents the activation function. Represents the weights of the fully connected layer, used to generate gated weights. The output of BiLSTM is the feature data that has been transformed into a uniform dimension through a dimensionality reduction layer. For graph features, the gated fusion mechanism uses dimensionality-level sigmoid gating to perform soft selection between structural information (hypergraph) and temporal context (BiLSTM), generating adaptive discriminative feature vectors. This enables the model to dynamically weigh graph and temporal structural information based on different data.

[0064] Step 2: Design of the OpenSetCenterHybridLoss loss function. OpenSetCenterHybridLoss is a multi-objective joint optimization loss function designed for open-set recognition scenarios, aiming to simultaneously improve the model's ability to distinguish known classes and its robustness against unknown classes. This loss function comprehensively incorporates cross-entropy loss, Center Loss, OpenMax rejection loss, and information entropy regularization, which are used to ensure classification performance, compress intra-class features, construct open space boundaries, and enhance sensitivity to uncertain inputs, respectively. Simultaneously, this function innovatively introduces a learnable margin optimization strategy for class centers, dynamically adjusting the minimum boundary distance between classes to strengthen inter-class separability. The complete hybrid open-set loss function can be expressed as: in, Represented as the known class cross-entropy loss, it is used as the basic supervised classification loss during the training phase. This term encourages the model to correctly classify samples of the known class and provides basic discriminative supervision. This is a penalty term for sample uncertainty. This term penalizes predictions with high uncertainty, enhances classification confidence, and helps improve the recognition accuracy of known classes. This is an open-space constraint term used to encourage the model to learn open-space rejection capabilities during training. This term penalizes the edges of the feature distribution, making low-confidence predictions more likely to reject unknown classes. Center loss is used to enhance the aggregation of similar samples in the feature space. , , , These are the hyperparameters that define the weights of each loss term, used to effectively improve the model's convergence and recognition performance. Each loss can be expressed as: in, The known class logits corresponds to the i-th sample; Label its actual category; The softmax output for each sample; Avoid dividing by zero for small positive numbers; The maximum probability output by softmax for each sample; Let i be the fusion feature representation of sample i; Let C be the center vector of its corresponding category. C is the total number of known categories (the number of categories in the classification task).

[0065] IV. Unknown Attack Detection Method Based on Weibull Modeling In unknown attack detection tasks, the lack of unknown class samples during the training phase makes it difficult for the model to accurately model the distribution characteristics of unknown classes. Consequently, during the inference phase, unknown attacks are easily misclassified as known classes, severely impacting the robustness and security of the detection. To address this challenge, this paper introduces an open-set recognition method based on Weibull distribution modeling. Utilizing the distance information between the activation vectors (logits) of known classes and their class centers during the training phase, the tail distribution of each class is constructed, thereby estimating the confidence that a sample belongs to that class. In the validation phase, the model first outputs the logits of the sample in each known class. By matching this with the pre-trained Weibull distribution, its "rejection probability" is calculated. When this value exceeds a set threshold, the sample is judged as an unknown attack. Figure 9 As shown.

[0066] Step 1: Feature Center Fitting. By aggregating the feature vectors of known samples from each class in the training set, the feature center of each class is calculated. The feature center, as the representative point of the class in the feature space, provides a benchmark for subsequently measuring the distance between new samples and each class, laying the foundation for constructing inter-class discrimination and determining unknown inputs. Feature Center of Each Class It can be represented as: in, Indicates the first Number of samples per class It is the feature center of this class. Represented as all belonging to the category Sample Index .

[0067] Step 2: Tail Distance Extraction. To capture the most representative "marginal sample" feature distribution in each category, this step selects the farthest values ​​from the distances of each sample to its corresponding category center, forming a tail set. These distances reflect the fluctuation of sample features near the category boundary, helping to characterize the distribution extension characteristics of the category in open space and laying the data foundation for fitting the tail distribution. Calculate the Euclidean distance between each training sample feature and its category center. It can be represented as: in, Represented as with the sample Real category The corresponding category center vector.

[0068] Step 3: Weibull Fitting. After obtaining the tail distances, this step uses methods such as maximum likelihood estimation to fit the Weibull distribution to each class's tail distance, obtaining the scale and shape parameters corresponding to each class. The scale parameter controls the degree of "stretching / compression" of the distribution curve on the number axis, while the shape parameter controls the "shape" of the distribution curve, determining the thickness of the tails and the skewness of the distribution. Through this modeling process, the extreme distribution of the distance between each class of samples and its center can be described statistically, thus providing an accurate probability estimation tool for calculating sample confidence and rejection probability during the inference stage. Therefore, Weibull fitting using the log-likelihood function can be expressed as: Among them, For scale parameters, For shape parameters, the maximum likelihood estimation (MLE) method is used for fitting.

[0069] Step 4: OpenMax Recalibration and Rejection Probability Estimation. This step utilizes the Weibull distribution parameters obtained in Step 3, combined with the distance between the test sample and each class center, to calculate the rejection probability of the sample belonging to each class. By probability reduction and redistribution of the original logits output, a new prediction space containing "unknown class" scores is constructed, thereby achieving response suppression of potentially unknown samples and explicit modeling of open classes. During the validation or testing phase, features are extracted from the test samples. Calculate its distance from the center of each category. It can be represented as: The tail cumulative distribution function (CDF) of this distance is calculated using the Weibull distribution fitted during the training phase to obtain the rejection probability. : Based on the rejection probability For each category, logits are recalibrated (OpenMax), and the recalibrated scores are... and confidence level of unknown classes The calculation formula can be expressed as: Among them, It is the logit value before the original Softmax, which is the original score of the classifier's last layer for that class. This is the score after recalibration. The confidence level for the unknown class.

[0070] Step 5: Category Judgment and Unknown Detection. After probability recalibration, the model makes a final decision based on the confidence scores of each category and the "unknown class." When the unknown class score is the highest or exceeds a set threshold, the sample is judged as an unknown attack; otherwise, it is classified into the corresponding known category. This step achieves unified judgment for known class identification and unknown class rejection, completing the entire process from feature extraction to open set decision-making, significantly enhancing the model's practicality and security in complex open environments. Final Probability Distribution It can be represented as: Where K represents the total number of known categories (i.e., the number of categories predefined in the classification task). f represents the feature vector of the input sample.

[0071] Experimental comparison: To demonstrate the weight changes between nodes in the hypergraph after the multi-view hyperedge fusion mechanism, a 12-node network traffic hypergraph class was created. This class supports adding five different types of hyperedges and implements five different hyperedge connection methods: feature similarity, port number, protocol type, source IP, and destination IP. Different weights are assigned to each hyperedge to represent its importance. The initialized nodes and weights are as follows: Feature similarity: connecting nodes [0,1,2,3], weight 0.8; Port number: connecting nodes [4,5,6], weight 0.7; Protocol type: connecting nodes [7,8,9,10], weight 0.9; Source IP: connecting nodes [2,5,8,11], weight 0.6; Destination IP: connecting nodes [3,6,9,11], weight 0.7. The multi-feature hypergraph of network traffic is shown below. Figure 1 As shown in (a), the hypergraph after the multi-view hyperedge fusion mechanism is as follows. Figure 1 As shown in (b).

[0072] This section experimentally verifies the effectiveness and robustness of the proposed open-set intrusion detection method, which combines multi-hypergraph neural networks (HGNN) and temporal modeling (LSTM), in complex real-world scenarios. The benchmark dataset used in the experiments is CIC-IDS2017, released by the Canadian Cyber ​​Security Institute (CIC) and widely used in intrusion detection system (IDS) research. This dataset covers various network attack types, including DoS, PortScan, Web attacks, BotNet, Infiltration, and BruteForce, and features high dimensionality, multiple categories, and strong temporal characteristics, enabling it to effectively simulate traffic behavior in real-world network environments. Therefore, Figure 2 This paper presents the confidence distribution of the proposed method for known and unknown attack samples. The results show that the confidence level for known attack samples is mainly concentrated above 80%, indicating high certainty and stability in the model's identification results. However, the confidence level for unknown attack samples is relatively dispersed, concentrated in the 20% to 50% range, indicating insufficient confidence in the model's identification when facing unknown threats. This significant difference in confidence level can provide a valid basis for rejection mechanisms or open-category identification of unknown attacks, further improving the security and robustness of the system in practical applications.

[0073] During the experiments, we manually categorized attack samples into known and unknown attack categories to simulate potential attack scenarios "not seen during training" in real-world systems, evaluating the model's open-set recognition capability. To enhance the model's open-space discrimination ability, we designed the OpenSetCenterHybridLoss loss function, combining cross-entropy loss, feature center constraints, and open-space uncertainty penalty to achieve dual optimization of known class aggregation and unknown class separation. In the validation phase, we introduced an OpenMax + Weibull fitting mechanism to model the distribution of class tails, thereby enhancing the rejection capability for unknown attacks. Figure 3 The diagram illustrates the performance changes of the model across different training epochs. The blue curve represents the accuracy rate for known attacks, the red curve represents the accuracy rate for unknown attacks, and the gray curve represents the average accuracy rate of the traditional method. The results show that as the number of training epochs increases, the accuracy rates for both known and unknown attacks gradually improve and tend to stabilize. However, the average accuracy rate of the traditional method shows a smaller increase, indicating that the model outperforms the traditional method in both known and unknown attack scenarios.

[0074] Figure 4 , Figure 5 This paper showcases the performance of our proposed method in various attack identification tasks, including known attacks, unknown attacks, and zero-day attacks, and compares its performance with the average identification rate of traditional methods. Experimental results show that our method achieves nearly 100% accuracy in identifying known attacks, and approximately 92% and 89% accuracy in identifying unknown and zero-day attacks, respectively. This significantly outperforms the average accuracy of traditional methods, which is less than 90%, validating the comprehensiveness and robustness of our proposed method in identifying multiple attack types. In particular, it demonstrates stronger generalization ability and practical value in dealing with unknown and zero-day threats.

[0075] The experiment compares the method with existing typical methods (such as Softmax+CE, OpenMax, OC-SVM, OpenGPN, etc.) and introduces multiple indicators (such as accuracy, F1-score, AUROC, unknown detection rate, etc.) for comprehensive evaluation to demonstrate the advantages and practicality of the method in actual open set intrusion detection tasks.

[0076] Table 1 Comparison of the effects of different methods As can be seen from the table and confusion matrix results, the proposed method for detecting unknown network attacks on power IoT terminals based on hypergraph temporal hybrid modeling achieves excellent performance in both known and unknown class identification tasks. Specifically, in known class classification, the model achieves an accuracy of 98.6%, indicating that the model has a very high ability to identify normal and common attack categories; in unknown class identification, the detection rate is as high as 87.3%, far exceeding traditional deep models and conventional open-set methods, demonstrating strong open-space generalization ability.

[0077] The confusion matrix shows that the predictions for known categories are mostly concentrated near the diagonal, with very few misclassifications, indicating that the model has good inter-class separability and intra-class aggregation. The detection ability for unknown categories is also excellent, with most unknown categories being successfully rejected as "Unknown", effectively reducing the risk of misclassification as known categories.

[0078] In comparisons with other methods (see the table of comparative experimental results), our method comprehensively outperforms other methods in key open-set metrics such as AUROC (0.940) and Open-set F1 score (0.91). In particular, compared with models using traditional cross-entropy loss (CE) or methods using OpenMax alone, our model improves the ability to detect unknown classes by 20% to 50%, verifying the crucial role of the synergistic optimization strategy of center loss and open-space penalty term in improving the model's generalization ability and robustness.

[0079] In summary, the proposed open-set intrusion detection model can not only effectively identify known attack types, but also maintain excellent recognition performance when facing new and unknown attacks, verifying the practical application value of this method in high-security scenarios such as the power Internet of Things.

[0080] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0081] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0082] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0083] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.< / port> < / ip> < / timestamp> < / ip>

Claims

1. A method for detecting unknown network attacks on power IoT terminals based on hypergraphs, characterized in that, Includes the following steps: Network traffic data is collected, and hypergraph structures from different perspectives are constructed. A unified high-order hyperedge connection matrix is ​​generated through a fusion strategy. Then, dynamic weighted fusion is performed on the hyperedge connection matrices from each perspective to generate the final unified fused hypergraph structure. The temporal hidden state vector of the obtained network traffic attack sample is extracted and mapped to a fixed-length representation of uniform dimension; Different feature fusion weights are dynamically assigned at different task stages, and cross-entropy loss, Center Loss, OpenMax rejection loss, and information entropy regularization term are introduced into the loss function. The rejection probability is calculated by matching the sample with a pre-trained Weibull distribution. When the rejection probability is higher than a set threshold, the sample is judged as an unknown attack.

2. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 1, characterized in that, Constructing hypergraph structures from different perspectives includes constructing hyperedges based on feature space similarity, constructing hyperedges based on protocol fields, and constructing hyperedges based on port usage patterns.

3. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 2, characterized in that, The specific steps for generating the final unified fused hypergraph structure are as follows: Assign learnable weight coefficients to each viewpoint Satisfies the normalization constraint: Next, the hyperedge connection matrices from each perspective are integrated using a weighted summation method to form the fused result: in Dynamic weights Learning through data-driven gated neural networks; The multi-view fusion mechanism ultimately generates the fused hyperedge connection matrix as follows: ,in The number of valid hyperedges retained after all perspectives are merged. The matrix has N rows × A column whose elements are real numbers; The merged hypergraph structure is represented as follows: 。 4. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 3, characterized in that, Different feature fusion weights are dynamically assigned at different task stages to jointly model the structural features extracted by the graph neural network and the temporal features extracted by the bidirectional long short-term memory network. Specifically, a fusion weight for each channel feature is learned through a sigmoid-activated gating function to achieve selective information fusion, as shown below: in, Represents the weights of the fully connected layer. For the output of BiLSTM, For graph features, This represents the activation function.

5. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 1, characterized in that, The loss function is expressed as follows: in, Represented as the cross-entropy loss of known classes, Penalty term for sample uncertainty For open space constraints, Loss at the center , , , These are the hyperparameters for the weights of each loss term.

6. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 1, characterized in that, The steps to determine an unknown attack are as follows: By aggregating the feature vectors of each known sample in the training set, the feature center of each category is calculated. Select the farthest values ​​from the distances of each sample to its corresponding class center to form the tail set; After obtaining the tail distance, the tail distance of each class is fitted with a Weibull distribution using methods such as maximum likelihood estimation to obtain the scale parameters and shape parameters corresponding to each class. During the verification or testing phase, features are extracted from the test samples. Calculate its distance from the center of each category. It can be represented as: The tail cumulative distribution function of this distance is calculated using the Weibull distribution fitted during the training phase, thus obtaining the rejection probability. : Based on the probability of rejection The logits for each category are recalibrated, and the recalibrated scores are... and confidence level of unknown classes The calculation formula is expressed as follows: Among them, This is the original logit value before Softmax, which is the original score of the classifier's last layer for that class. This is the score after recalibration. Confidence level for the unknown class; The model makes a final decision based on the confidence scores of each category and the unknown category. When the score of the unknown category is the highest or exceeds the set threshold, the sample is judged as an unknown attack; otherwise, it is classified into the corresponding known category.

7. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 1, characterized in that, Before extracting the temporal hidden state vector of the obtained network traffic attack sample, the multi-dimensional relationship features between devices are aggregated through the established hypergraph structure, and the OpenMax mechanism is used to isolate potential unknown attack samples in advance in the feature space.

8. The method for detecting unknown network attacks on power IoT terminals based on hypergraphs according to claim 7, characterized in that, The specific steps for using the OpenMax mechanism to isolate potential unknown attack samples in advance in the feature space are as follows: By modeling the higher-order relationships between device samples through hypergraph structure modeling, we can obtain context-aware structural feature representations, construct a hypergraph and perform node feature aggregation, input the original feature vector, construct a set of hyperedges based on multi-view relationships, and form a hypergraph association matrix that reflects the higher-order structural relationships between samples. The original features are aggregated into structural embedding features using a hypergraph structure, as shown in the following formula: in Represents the original feature matrix, For trainable parameter weights, For activation function, This is the node-hyperedge connection matrix. It is the hypermarginality matrix. Let the node degree matrix be... This is the hyperedge weight matrix. The output is structure-aware features; For aggregation results Perform one layer of ReLU activation, and the result is still denoted as... , dimension For each known class in the training set Calculate its feature center The formula is as follows: Where S k This indicates that it belongs to category c. k The set of all training samples; Based on OpenMax, the unknown class rejection decision is performed by detecting potential unknown attack samples in advance in the feature space and rejecting them. Then, for each sample... The formula for calculating the Euclidean distance to each type of center is: Potentially unknown attack samples are detected in advance in the feature space and rejected. A Weibull distribution is fitted, and the distance set for each known class is calculated. By fitting a Weibull distribution, we obtain an estimate of the tail distribution for each class. The probability of a sample being rejected as an unknown class is calculated using the distance and the fitted distribution: CDFWeibull k Let represent the cumulative distribution function of the Weibull distribution fitted for the k-th known class; like If the threshold τ is reached, the sample is classified as an unknown attack class; otherwise, the known class corresponding to the highest confidence level is retained as the prediction result.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the method for detecting unknown network attacks on power Internet of Things terminals based on a hypergraph, as described in any one of claims 1 to 8.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the method for detecting unknown network attacks on power Internet of Things terminals based on a hypergraph as described in any one of claims 1 to 8.

Images