Power network distributed cooperative defense method, system and device based on graph neural network, and storage medium

Abstract

The invention relates to the technical field of power network security protection, in particular to a power network distributed cooperative defense method, system and device based on a graph neural network and a storage medium. The method comprises the following steps of: constructing a multi-relation graph structure comprising a master station, a substation and terminal equipment, and extracting node local embedding and full-graph-level situation embedding by adopting a graph neural network; establishing a centralized evaluation network to carry out topological position differentiation evaluation, and constructing a distributed action execution network to realize localized defense decision; a centralized training and distributed execution mechanism is adopted, a global strategy is uniformly optimized in a training stage, and each node independently executes a defense action in an execution stage; strategy iteration optimization is carried out through defense execution feedback, and attack mode changes are dynamically adapted. The technical problems of insufficient topology utilization, high response time delay and weak adaptive capacity in traditional power network defense are solved.

Description

Technical Field

[0001] This invention relates to the field of power network security protection technology, and in particular to a distributed collaborative defense method, system, device and storage medium for power networks based on graph neural networks. Background Technology

[0002] With the deepening of the digital transformation of the power system, the power network presents a complex topology with multiple interconnected levels of master stations, substations, and terminal equipment. Under this architecture, cybersecurity threats are no longer limited to single-point attacks, but rather manifest as a chain attack pattern that propagates along the topology links. Traditional power network security protection mainly relies on rule-based intrusion detection and centralized monitoring, using predefined security policies to identify and block known attack patterns.

[0003] Existing power network endpoint defense technologies typically employ a layered protection architecture, including functional modules such as perimeter firewalls, intrusion detection, behavioral analysis, and isolation and handling. While these defense methods are effective against traditional network attacks, they reveal significant shortcomings when facing complex power network topologies and dynamic attack scenarios. First, existing methods are primarily based on single-point feature analysis, lacking the ability to model the overall network topology and making it difficult to accurately assess the varying impacts of attacks on nodes at different locations on overall network security. Second, traditional defense strategies rely on preset rules and expert experience, lacking adaptive learning capabilities and failing to effectively address zero-day attacks and unknown threats.

[0004] Regarding defense execution mechanisms, existing technologies mostly adopt a centralized decision-making architecture, where all defense actions need to be reported to a central authority for unified processing. This approach suffers from high communication overhead and high response latency in large-scale power grids. Furthermore, due to the lack of a global coordination mechanism, distributed defense methods are prone to inconsistencies between local decisions and global objectives, affecting the overall defense effectiveness. Summary of the Invention

[0005] In view of the problems existing in the prior art, the present invention is proposed.

[0006] Therefore, the problem to be solved by this invention is how to make full use of power network topology information to improve the accuracy of defense strategies, how to achieve an organic combination of centralized global optimization and distributed rapid execution, and how to build a collaborative defense mechanism with adaptive learning capabilities, so as to achieve effective protection against complex dynamic attacks while ensuring the continuity of critical business.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a distributed collaborative defense method for power networks based on graph neural networks, which includes: acquiring the topology of the power network and constructing a multi-relationship graph structure; extracting structural features from the multi-relationship graph model using a graph neural network to obtain local node embeddings and full-graph-level situational embeddings;

[0009] A centralized evaluation network is constructed, which receives the local embedding of the nodes and the full-graph-level situational embedding. The value of defense actions is evaluated based on the differences in the position of the nodes in the topology. A distributed action execution network is constructed, which generates defense actions based on local node characteristics and limited neighborhood information. The defense actions include traffic rate limiting, whitelist filtering, isolation and disposal, and path redirection.

[0010] Through centralized training and distributed execution, the centralized evaluation network is used to uniformly optimize the global strategy during the training phase, while each node independently executes defensive actions during the execution phase.

[0011] The strategy is iteratively optimized based on the feedback of defense execution, and the defense strategy is dynamically adjusted to adapt to changes in attack patterns.

[0012] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the construction of the multi-relationship graph structure includes: establishing a network topology model covering the master station, substations, interval layers, and terminal equipment; determining the correspondence between nodes and edges; collecting the communication characteristics, security characteristics, and service characteristics of nodes; and collecting the bandwidth utilization and latency characteristics of links; and slicing the topology into time-series snapshots according to a fixed sampling period to form a time-graph data sequence.

[0013] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the step of extracting structural features from the multi-relationship graph model using graph neural networks includes: employing a relationship-aware message passing mechanism to process multiple relationships and directed edges, enabling nodes to receive weighted information from neighbors of different relationships and directions; adding role and position encoding to the input, and encoding time snapshots as trend vectors through a time-series gating unit; and generating a global embedding vector reflecting the overall network security situation through graph readout operations.

[0014] The beneficial effects of this preferred technical solution are as follows: It achieves accurate modeling of complex power network topology through a relationship-aware message passing mechanism, enabling each node to acquire differentiated information from different types of neighbors, thereby accurately identifying attack propagation paths. Role-position encoding ensures that the importance of nodes in the global topology is correctly assessed, while the timing gating unit captures the temporal evolution characteristics of attack behavior. The global embedding vector generated by the graph readout operation provides a unified situational awareness basis for subsequent global policy coordination.

[0015] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the centralized evaluation network includes incorporating node embeddings and full-graph-level embeddings output by the graph neural network into the centralized evaluation network.

[0016] The evaluation process is performed at two granularities: node-by-node evaluation and global action summary evaluation. The system receives key business constraints and security policy status at the input end and provides uncertainty metrics at the output end.

[0017] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the distributed action execution network includes: splitting the action network and deploying it to each node; making decisions based on local input and neighborhood summaries; output action types include normal access, gray-scale rate limiting, whitelist priority access, observation isolation, hard isolation, rerouting bypass, and telemetry downscaling; and built-in stabilization strategies to avoid action jitter, including minimum action duration, conflict action priority, and critical link action mask.

[0018] The advantages of this preferred technical solution are as follows: Distributed deployment ensures real-time response capabilities for defense actions, avoiding communication bottlenecks and latency issues associated with centralized decision-making. Diverse action types cover a range of defense strengths, from minor restrictions to complete isolation, enabling precise handling based on threat levels, ensuring both effective security protection and maximizing business continuity. Built-in stabilization policies prevent network jitter caused by frequent policy switching, and action prioritization and masking mechanisms ensure the protection of critical business traffic, achieving an optimal balance between defense effectiveness and business stability.

[0019] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the centralized training and distributed execution include: regionalized sharding training during the training phase, using a priority sampling mechanism to focus on high-risk samples; a closed-loop mechanism of grayscale-rollback-volume release for version release; and each node making independent decisions based solely on local and neighboring summaries during the execution phase, with the centralized side distributing update parameters at a set frequency.

[0020] As a preferred embodiment of the distributed collaborative defense method for power networks based on graph neural networks described in this invention, the defense execution feedback and strategy iteration optimization include: collecting four types of feedback metrics: security effect, business impact, strategy quality, and resource overhead; performing multi-scale aggregation analysis of time and space; establishing concept drift and data drift monitoring, and initiating accelerated training or strategy rollback when the threshold is exceeded.

[0021] Secondly, embodiments of the present invention provide a distributed collaborative defense system for power networks based on graph neural networks, which includes a topology modeling module for acquiring the topology of the power network and constructing a multi-relationship graph structure;

[0022] The graph neural network module is used to extract structural features from the multi-relation graph model to obtain local node embeddings and full-graph-level situational embeddings.

[0023] A centralized evaluation network module is used to evaluate defense strategies based on topological location differentiation.

[0024] The distributed action execution network module is used to deploy on each node and make defense action decisions based on local characteristics;

[0025] The training execution management module is used to implement a centralized training and distributed execution mechanism;

[0026] The feedback iteration module is used to iteratively optimize strategies based on defense execution feedback.

[0027] Thirdly, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, they implement the steps of the distributed collaborative defense method for power networks based on graph neural networks as described in the first aspect of the present invention.

[0028] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the distributed collaborative defense method for power networks based on graph neural networks as described in the first aspect of the present invention.

[0029] The beneficial effects of this invention are as follows: By constructing a multi-relationship graph structure and using graph neural network feature extraction, this invention achieves accurate modeling of the complex topological relationships of power networks, enabling defense strategies to accurately reflect the positional importance and business relevance of different nodes in the network, thus overcoming the technical shortcomings of traditional methods that cannot utilize network structure information. The centralized evaluation network, based on a topology location-differentiated evaluation mechanism, ensures that the same defense action receives differentiated value scores in different topological locations, while the distributed action execution network reduces response latency through localized decision-making, solving the communication bottleneck problem of centralized defense. The collaborative mechanism of centralized training and distributed execution ensures both global policy consistency and millisecond-level real-time response capabilities. Defense execution feedback and policy iteration, through multi-scale data aggregation and concept drift monitoring, enable the system to continuously learn and adapt, dynamically responding to new attack patterns. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart of a distributed collaborative defense method for power networks based on graph neural networks.

[0032] Figure 2 This is a computer equipment diagram for a distributed collaborative defense method for power networks based on graph neural networks.

[0033] Figure 3 This is a schematic diagram of the reinforcement learning architecture for a distributed collaborative defense method for power networks based on graph neural networks.

[0034] Figure 4 This is a schematic diagram of the distributed reinforcement learning architecture based on graph neural networks for a distributed collaborative defense method for power networks. Detailed Implementation

[0035] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0036] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0037] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0038] Example 1

[0039] Reference Figure 1 - Figure 2 This is the first embodiment of the present invention, which provides a distributed collaborative defense method for power networks based on graph neural networks, including:

[0040] S100: Obtain the power network topology and construct a multi-relationship graph structure. Extract structural features from the multi-relationship graph model through a graph neural network to obtain local node embeddings and full-graph-level situational embeddings.

[0041] S200: Construct a centralized evaluation network that receives local node embeddings and full-map situational embeddings. It evaluates the value of defensive actions based on the differences in the position of nodes in the topology. Construct a distributed action execution network that generates defensive actions based on local node characteristics and limited neighborhood information. The defensive actions include traffic rate limiting, whitelist filtering, isolation and disposal, and path redirection.

[0042] S300: Through centralized training and distributed execution, a centralized evaluation network is used to uniformly optimize the global strategy during the training phase, while each node independently executes defensive actions during the execution phase.

[0043] S400: Iterates and optimizes strategies based on defense execution feedback, dynamically adjusting defense strategies to adapt to changes in attack patterns.

[0044] It should be noted that power grids, as critical national infrastructure, face unique security challenges. Power grid topology exhibits a clear hierarchy and business interdependence, with master stations handling dispatch and control functions, branch stations responsible for regional management, and terminal devices performing specific protection and data acquisition tasks. Attackers often exploit this hierarchical structure, using low-privilege terminal devices as springboards to gradually infiltrate the core control system. Traditional single-point protection methods are inadequate to address this topology-based attack propagation pattern, while centralized defense suffers from single-point failure risks and response delays.

[0045] Therefore, by employing the S100-S400 technical solution, a topology awareness capability based on graph neural networks is constructed to achieve deep modeling of complex relationships within power networks and accurate prediction of attack propagation paths. A defense architecture combining centralized evaluation and distributed execution is established, ensuring global policy consistency while achieving rapid local response. Through a continuous feedback learning mechanism, the system can dynamically adapt to new attack patterns and changes in the network environment. This invention addresses the technical challenges of insufficient topology utilization, excessively high response latency, and weak adaptability in power network defense.

[0046] Example 2

[0047] Reference Figure 2 - Figure 4 This is the second embodiment of the present invention.

[0048] In this embodiment, step S100 involves acquiring the power network topology and constructing a multi-relationship graph structure. Structural features are extracted from the multi-relationship graph model using a graph neural network to obtain local node embeddings and full-graph-level situational embeddings. This includes the following steps A1-A2:

[0049] A1: Constructing a multi-relationship graph structure includes: establishing a network topology model covering the main station, substations, interval layers, and terminal devices; determining the correspondence between nodes and edges; collecting the communication characteristics, security characteristics, and service characteristics of nodes; and collecting the bandwidth utilization and latency characteristics of links; and slicing the topology into time-series snapshots according to a fixed sampling period to form a time-graph data sequence.

[0050] Specifically, a network topology model is first established, covering the main station, substations, interval layers, and terminal equipment (such as protection devices, remote terminals, metering and status acquisition equipment), clarifying the correspondence between nodes (equipment, stations, business function units) and edges (links, logical dependencies, access paths). The topology is extracted to obtain a directed or multi-relationship graph, including relationships such as main station → substation, substation → terminal, intra-station equipment, cross-regional station, and subordinate relationships within the business control loop. The direction, relationship label, and topology level information are recorded for each edge. To reflect dynamism, the topology is sliced ​​into time-series snapshots at fixed sampling periods (e.g., 1s / 5s / 60s), forming a "time × graph" data sequence for subsequent learning of structural temporal characteristics.

[0051] The node side collects three quantifiable features: communication, security, and services, and performs sliding window aggregation (e.g., within the last 5 seconds, 1 minute, and 10 minutes) to account for both bursty and stable trends. Communication features include: uplink / downlink bit rate and packet rate, concurrent connections, new connection rate, session lifetime quantiles (e.g., P50 / P95), inbound / outbound port distribution, port entropy, destination address deduplication count, first packet delay, round-trip delay jitter, retransmission ratio, window scaling and congestion indication, fragmentation and packet reassembly counts, and percentage and rate by protocol family (IEC 60870-5-104, DNP3, Modbus TCP, IEC 61850 MMS / GOOSE / SV, SNMP, NTP, HTTP / S). To ensure the effectiveness of feature collection, a dynamic feature weight adjustment mechanism is introduced. The importance weight of different feature types is dynamically adjusted based on the current network status and threat level.

[0052] w i (t)=w base,i ·(1+α threat ·s i )

[0053] Among them, w base,i α is the basic weight of feature i. threat s represents the threat level impact coefficient. i denoted as the sensitivity coefficient of feature i to threats.

[0054] Security features include: intrusion detection and traffic analysis scores, blacklist / whitelist hit counts, anomaly clustering labels, failed authentication counts, password brute-force attempt rates, port scanning and lateral movement indication scores, periodic beacon strength, suspicious domain / address reputation scores, and past K-window alarm frequency and duration. Business features include: device role (primary / backup, acquisition / control), associated control loop and criticality level, allowable latency and packet loss limits (service level constraints), switching redundancy capabilities, and planned / unplanned power outage indicators. Link-side data collection includes: rated and instantaneous bandwidth utilization, queuing depth and drop rates, single-hop latency and jitter, bit error rate and interface error rate, link medium (fiber optic / industrial Ethernet / leased line / MPLS), trusted boundary (production / office / third-party access), VLAN / VRF identifiers, routing cost, and hop count to the master station. All features undergo time alignment and missing value processing (forward padding / median imputation) at the edge, and are normalized by site dimension to ensure stable input scale for subsequent models. The purpose of this step is to make complex power networks "computable" and "learnable".

[0055] A2: Structural feature extraction of multi-relationship graph models through graph neural networks includes: using a relationship-aware message passing mechanism to handle multiple relationships and directed edges, enabling nodes to receive weighted information from neighbors of different relationships and directions; adding role position encoding to the input and encoding time snapshots as trend vectors through time-series gating units; and generating a global embedding vector reflecting the overall network security situation through graph readout operations.

[0056] Specifically, after the graph input is constructed, a graph neural network capable of handling multiple relationships and directions is used for structure-aware encoding. For various relationships (inter-station, intra-station, control subordination, business co-occurrence) and directed edges, a relationship-aware message passing mechanism is used, allowing nodes to receive weighted information from neighbors of different relationships and directions in several aggregation layers. The number of layers is generally set to 2–4 layers to balance representational capability and the risk of oversmoothing; on large-scale graphs, neighbor sampling or cluster-based subgraph training is used to ensure scalability.

[0057] The message passing formula for graph neural networks has been optimized for scenarios with multiple relationships:

[0058]

[0059] in, Let R represent the feature representation of node i at level l, and let R be a set of relation types. Let i be the set of neighbors of node i under relation r. Let be the attention weight of node j to node i under relation r. Let r be the weight matrix of relation r at level l. Let σ be the self-connection weight matrix, and σ be the activation function.

[0060] To characterize the "position of a node in the global context", role / position encoding (e.g., spectral position based on graph Laplace, hop count to the main station, and community number) is added to the input. The aforementioned time snapshots are encoded into short- to medium-term trend vectors through stacking or time-series gating units, so that the embedding simultaneously includes static topology and dynamic traffic situation.

[0061] The encoding yields two types of results: first, local embeddings for each node, integrating its communication, security, and business characteristics with its neighborhood structure; and second, region-level / full-graph-level embeddings obtained through readout operations (such as weighted averaging or attention aggregation), used to characterize the overall situation of network congestion / alarms / business load. During training, two auxiliary prediction heads are added to improve representation quality: one predicts the risk level of nodes (weakly supervised labels constructed based on historical handling results and expert annotations), and the other predicts the probability of critical businesses being affected (labels constructed based on business latency / packet loss exceeding limits). This step transforms the coupling relationship of "topology-business-security" into a structured vector expression that can be directly used for policy evaluation and action decision-making.

[0062] In an optional implementation, the construction of the multi-relationship graph structure in step S100 can also incorporate power flow analysis results of the power network, using electrical distance as weight information for the graph structure. By calculating the electrical distance between nodes, the actual correlation strength between power equipment can be more accurately reflected, thereby improving the modeling accuracy of the graph neural network for the topological characteristics of the power network.

[0063] In another optional implementation, the construction of the multi-relationship graph structure in step S100 can also manage the graph complexity through a hierarchical sampling strategy. First, a backbone topology graph is constructed, including the main master station and branch station nodes; then, terminal nodes are selectively added according to business importance and security risk level; finally, a graph compression algorithm is used to retain key topological features to ensure the computational efficiency of the graph neural network.

[0064] In this embodiment, the centralized evaluation network construction and distributed action execution network construction in step S200 include the following steps B1-B2:

[0065] B1: The centralized evaluation network includes incorporating the node embeddings and full-graph-level embeddings from the graph neural network output into the centralized evaluation network;

[0066] The evaluation process is performed at two granularities: node-by-node evaluation and global action summary evaluation. The system receives key business constraints and security policy status at the input end and provides uncertainty metrics at the output end.

[0067] Specifically, during the training phase, the node embeddings and global embeddings output by the graph neural network are fed into a centralized evaluation network to consistently assess the merits of the current state and combinations of node actions based on the current state. The evaluation network consists of a graph encoder and several layers of fully connected networks, and can operate at two granularities: first, it performs node-by-node evaluation based on "node-action pairs" to guide the policy updates of each node; second, it performs a "global action summary evaluation" to provide an overall merit score when it is necessary to jointly weigh link congestion, cross-regional coordination, and critical business continuity.

[0068] The centralized evaluation network employs a two-branch architecture, handling local and global evaluations separately. The local evaluation branch performs value assessments on the state-action relationships of individual nodes.

[0069] V local (s i ,a i ) = MLP local ([h i ,h global ,c i ,a i ])

[0070] Among them, s i Let a be the state of node i. i For the corresponding action, h i For the local embedding of node i, h global For full-graph level embedding, c i For business constraint vectors, MLP local A multilayer perceptron for local evaluation.

[0071] The global evaluation branch considers the synergistic effect of multiple node actions, and assesses the overall defense effectiveness by aggregating information from multiple nodes:

[0072]

[0073] Where a = [a1, a2, ... a N ] represents the action vector of all nodes, w i The importance weight of node i is determined by the node's business criticality and topological location.

[0074] To ensure training stability and interpretability, the evaluation network explicitly receives "business-critical constraints" and "security policy whitelist / blacklist status" at the input end, and provides uncertainty measures at the output end (e.g., variance estimation obtained through Monte Carlo perturbation or multi-head output) for rollback decisions in the subsequent security execution phase.

[0075] The evaluation network reflects the fact that "different topological locations lead to different impacts of the same action" in the scores: for example, the same bandwidth limiting action may be almost harmless on non-critical monitoring terminals, but unacceptable on protection device paths; the same isolation action may effectively block propagation at edge aggregation ports, but may cause widespread service interruption at backbone links. The value of centralized evaluation lies in unifying measurement standards and balancing global security and business objectives, providing authoritative and consistent training signals for distributed action networks (next step).

[0076] B2: The distributed action execution network includes splitting the action network and deploying it to each node, making decisions based on local input and neighborhood summaries; output action types include normal access, gray-scale rate limiting, whitelist priority access, observation and isolation, hard isolation, rerouting bypass, and telemetry downscaling; built-in stabilization strategies avoid action jitter, including minimum action hold duration, conflict action priority, and critical link action mask.

[0077] Specifically, the action network is split and deployed to each node or its nearest edge network element, enabling it to make rapid decisions based on local inputs and limited neighborhood summaries without accessing global data. The action network inputs at each node include: recent multi-scale sliding window communication / security / service characteristics of the node, the latest embeddings derived for the node by the graph neural network (which can be updated according to the training cycle), compressed statistics of the limited radius neighborhood (such as congestion and alarm counts of the previous and next hops), and execution constraints issued by the site or region (such as prohibiting hard isolation of certain service flows). The output is a combination of "action type + fine-grained parameters". The action type is limited to a set that can be implemented and audited in the project: normal access; gray-scale rate limiting (given target rate or allowed percentage); whitelist priority access (only allowing business-critical protocols, source and destination combinations); observation and isolation (migrating to an isolated VLAN or redirecting traffic to detection / cleaning equipment); hard isolation (blocking sessions, sources, or destinations, including duration and unblocking conditions); rerouting / bypassing (redirecting suspicious traffic to honeypots or cleaning links); telemetry downscaling (reducing the reporting frequency of non-critical monitoring flows to alleviate flooding). Parameters include: target rate limiting value or allowed percentage, whitelist rule set identifier, isolation / bypass target instance identifier and duration, blocking granularity (five-tuple / source address / subnet), and telemetry sampling rate.

[0078] To avoid "action jitter" and mutual interference, the node-side action network has built-in stabilization strategies: minimum retention time for actions of the same class, merging and deduplication of similar actions, cooldown time, priority table for conflicting actions (e.g., business whitelist takes precedence over rate limiting, and rate limiting takes precedence over hard isolation), and action masks for critical links and core terminals. The node side also retains local audit logs, recording the reasons for action triggering (main characteristics, neighborhood state summary, policy version, and confidence level) for post-event traceability.

[0079] Action stability is assessed by the consistency of historical action sequences:

[0080]

[0081] Where K is the historical window length and l[·] is the indicator function. When the stability score is below the threshold, the system will extend the holding time of the current action to avoid frequent policy changes.

[0082] In an optional implementation, the centralized evaluation network in step S200 can also integrate a multi-objective optimization mechanism to simultaneously consider three objectives: security effectiveness, business continuity, and resource consumption. Through Pareto front search, it finds the optimal balance between security and business continuity, providing flexible strategy options for different application scenarios.

[0083] In another optional implementation, the distributed action execution network in step S200 can also introduce a federated learning mechanism to achieve collaborative learning among multiple nodes while protecting local data privacy. Each node shares model parameters but not the original data, ensuring both learning effectiveness and meeting the stringent data security requirements of the power system.

[0084] This step translates "global intelligence during the training phase" into "local, real-time processing capabilities during the execution phase."

[0085] In this embodiment, the centralized training and distributed execution in step S300 includes the following steps C1-C3:

[0086] C1: During the training phase, regionalized segmentation training is adopted, and a priority sampling mechanism is used to focus on high-risk samples;

[0087] C2: Version release adopts a closed-loop mechanism of gray-scale - rollback - large-scale release;

[0088] C3: During the execution phase, each node makes independent decisions based solely on its local and neighboring summaries, while the centralized side distributes updated parameters at a set frequency.

[0089] Specifically, the training phase operates in a centralized environment: continuously collecting states, candidate actions, and execution results from the entire network to construct high-quality experience samples; employing regional or sharded training, first converging within the station and region, then merging across regions; using a priority sampling mechanism to focus on samples with high misjudgment rates and significant business impact; introducing behavioral cloning of "expert rules / historical handling strategies" in the early stages of training to ensure the initial strategy is conservative and usable; subsequently, iterating using a policy gradient-based optimization method, synchronously updating the action network parameters of various nodes under the unified guidance of the evaluation network. Version releases adopt a closed-loop "grayscale—rollback—mass rollout": first deploying the new version on a small scale in low-risk areas, monitoring key indicators (critical business latency, packet loss, false positive rate, attack interception rate, action jitter rate); gradually expanding after meeting the standards, and automatically reverting to the previous stable version if the standards are not met. To meet the computational and time-sensitive requirements of large-scale graphs, training employs neighbor sampling, micro-batch subgraphs, and model distillation (compressing heavy graph encoders into lightweight edge feature transformations) to ensure that the training and deployment cycle (e.g., daily / weekly) matches the field maintainability.

[0090] The execution phase is fully distributed: each node can make independent decisions based solely on local and a very small number of neighborhood summaries, avoiding the transmission of raw traffic or the entire topology to the central server, thus reducing bandwidth and latency overhead. The centralized side only distributes updated action network parameters and node embedding mapping tables at a set frequency, and issues policy boundaries and whitelists. In the event of communication anomalies or low model confidence, nodes automatically revert to a pre-set conservative rule baseline, ensuring the continuity of critical services. This step achieves a balance between "globally consistent guidance + rapid local implementation," which is key to the scalable application of this invention in real-world power networks.

[0091] In an optional implementation, the centralized training and distributed execution in step S300 can also be achieved by introducing a course learning mechanism, starting training from simple attack scenarios and gradually increasing the complexity of the scenarios and the diversity of attack methods. Through a gradual learning process, the model's understanding and ability to respond to complex attack patterns can be improved.

[0092] In another optional implementation, the centralized training and distributed execution in step S300 can also be achieved by employing an online adaptation strategy based on reinforcement learning. When a change in the network environment or attack pattern is detected, the system automatically initiates an online learning mode, adjusting the model parameters in real time using an incremental learning algorithm.

[0093] In this embodiment, the defense execution feedback and strategy iteration optimization in step S400 includes the following steps D1-D2:

[0094] D1: Collect four types of feedback metrics: security effectiveness, business impact, strategy quality, and resource overhead;

[0095] D2: Perform multi-scale aggregation analysis of time and space;

[0096] D3: Establish concept drift and data drift monitoring, and initiate accelerated training or policy rollback when the threshold is exceeded.

[0097] Specifically, once the node-side action network issues a specific action, the edge device immediately executes it on the data plane and reports the execution summary and result metrics to the monitoring and training system. Feedback covers four categories of metrics: security effectiveness (attack interception rate, lateral movement blocking rate, alarm clearing time, percentage of unknown attacks discovered), business impact (latency and packet loss exceeding limits for critical services, service availability and recovery time), policy quality (false positive and false negative rates, action jitter rate, average action duration, number of rollback triggers), and resource overhead (bandwidth and computational utilization, policy issuance / effectiveness latency, log and auditing costs). The system performs multi-scale aggregation of feedback in time and space: short-term detection of explosive attacks and rapid policy fine-tuning; medium-term identification of stable adversarial patterns and structural weaknesses; and long-term driving of retraining and model recalibration. To resist environmental and adversary policy drift, concept drift and data drift monitoring are established; when thresholds are exceeded, temporary accelerated training or policy freezing and rollback are initiated. Through this closed loop, the model can continuously absorb the latest developments, improving interception efficiency and handling accuracy without sacrificing critical business service levels. This step ensures that the invention has the adaptive capability of becoming "more accurate with use and stronger with each battle".

[0098] In an optional implementation, the defense execution feedback and strategy iteration optimization in step S400 can also be achieved by integrating an external threat intelligence platform to correlate and analyze threat intelligence data with internal feedback data. By leveraging the prior knowledge of threat intelligence, the effectiveness of defenses can be assessed more accurately, and potential threats can be identified.

[0099] In another optional implementation, the defense execution feedback and strategy iterative optimization in step S400 can also employ a meta-learning-based rapid adaptation mechanism. The meta-learning algorithm learns how to learn quickly, enabling the system to rapidly adjust its defense strategy when encountering new types of attacks.

[0100] In summary, during the topology modeling phase, through multi-relationship graph construction and dynamic feature weight adjustment mechanisms, the system can accurately capture the hierarchical structural features and business relationships of the power network, providing rich contextual information for subsequent defense decisions. The relation-aware message passing mechanism and location encoding design of the graph neural network enable each node to obtain a comprehensive representation integrating topology, neighborhood states, and temporal changes, improving the ability to identify complex attack propagation paths. The centralized evaluation network, through a dual-branch architecture and business constraint processing, achieves a precise trade-off between security effectiveness and business continuity, avoiding the negative impact of excessive defense on critical services. The distributed action execution network's diverse action type design and stable strategy mechanism ensure the flexibility and stability of defense responses, capable of handling threats of varying intensities while maintaining network operational stability.

[0101] Example 3

[0102] The above is an illustrative scheme of a distributed collaborative defense method for power networks based on graph neural networks. It should be noted that the technical solution of this distributed collaborative defense system for power networks based on graph neural networks belongs to the same concept as the aforementioned distributed collaborative defense method for power networks based on graph neural networks. Details not described in detail in the technical solution of the distributed collaborative defense system for power networks based on graph neural networks in this embodiment can be found in the description of the aforementioned distributed collaborative defense method for power networks based on graph neural networks.

[0103] This embodiment also provides a distributed collaborative defense system for power networks based on graph neural networks, including:

[0104] The topology modeling module is used to obtain the power network topology and construct a multi-relationship graph structure.

[0105] The graph neural network module is used to extract structural features from the multi-relation graph model to obtain local node embeddings and full-graph-level situational embeddings.

[0106] A centralized evaluation network module is used to evaluate defense strategies based on topological location differentiation.

[0107] The distributed action execution network module is used to deploy on each node and make defense action decisions based on local features; the training execution management module is used to implement a centralized training and distributed execution mechanism.

[0108] The feedback iteration module is used to iteratively optimize strategies based on defense execution feedback.

[0109] This embodiment also provides an electronic device applicable to distributed collaborative defense of power networks based on graph neural networks, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the distributed collaborative defense method for power networks based on graph neural networks proposed in the above embodiment.

[0110] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the distributed collaborative defense method for power networks based on graph neural networks as proposed in the above embodiments.

[0111] The storage medium proposed in this embodiment and the distributed collaborative defense method for power networks based on graph neural networks proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0112] Based on the above description of the implementation methods, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A distributed collaborative defense method for power networks based on graph neural networks, characterized in that: This includes acquiring the power network topology and constructing a multi-relationship graph structure, extracting structural features from the multi-relationship graph model using a graph neural network, and obtaining local node embeddings and full-graph-level situational embeddings. A centralized evaluation network is constructed, which receives the local embedding of the nodes and the full-graph-level situational embedding. The value of defense actions is evaluated based on the differences in the position of the nodes in the topology. A distributed action execution network is constructed, which generates defense actions based on local node characteristics and limited neighborhood information. The defense actions include traffic rate limiting, whitelist filtering, isolation and disposal, and path redirection. Through centralized training and distributed execution, the centralized evaluation network is used to uniformly optimize the global strategy during the training phase, while each node independently executes defensive actions during the execution phase. The strategy is iteratively optimized based on the feedback of defense execution, and the defense strategy is dynamically adjusted to adapt to changes in attack patterns.

2. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 1, characterized in that: The construction of the multi-relationship graph structure includes: establishing a network topology model covering the main station, substations, interval layers and terminal devices; determining the correspondence between nodes and edges; collecting the communication characteristics, security characteristics and service characteristics of nodes; and collecting the bandwidth utilization and latency characteristics of links; and slicing the topology into time-series snapshots according to a fixed sampling period to form a time and graph data sequence.

3. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 2, characterized in that: The structural feature extraction of the multi-relationship graph model through graph neural networks includes: using a relationship-aware message passing mechanism to process multiple relationships and directed edges, enabling nodes to receive weighted information from neighbors of different relationships and directions; adding role position encoding to the input and encoding time snapshots as trend vectors through a time-series gating unit; and generating a global embedding vector reflecting the overall network security situation through graph readout operations.

4. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 3, characterized in that: The centralized evaluation network includes incorporating node embeddings and full-graph-level embeddings from the graph neural network output into the centralized evaluation network. The evaluation process is performed at two granularities: node-by-node evaluation and global action summary evaluation. The system receives key business constraints and security policy status at the input end and provides uncertainty metrics at the output end.

5. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 4, characterized in that: The distributed action execution network includes splitting the action network and deploying it to each node, making decisions based on local input and neighborhood summaries; the output action types include normal access, gray-scale rate limiting, whitelist priority access, observation and isolation, hard isolation, rerouting bypass, and telemetry downscaling. Built-in stabilization strategies prevent motion jitter, including minimum motion duration, conflicting motion priority, and critical link motion masking.

6. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 5, characterized in that: The centralized training and distributed execution include: regionalized segmented training during the training phase, and a priority sampling mechanism to focus on high-risk samples; and a closed-loop mechanism of gray-scale-rollback-volume release for version release. During the execution phase, each node makes independent decisions based solely on its local and neighboring summaries, while the centralized side distributes updated parameters at a set frequency.

7. The distributed collaborative defense method for power networks based on graph neural networks as described in claim 6, characterized in that: The defense execution feedback and strategy iteration optimization include collecting four types of feedback metrics: security effect, business impact, strategy quality, and resource overhead; conducting multi-scale aggregation analysis in time and space; establishing concept drift and data drift monitoring, and initiating accelerated training or strategy rollback when thresholds are exceeded.

8. A distributed collaborative defense system for power grids based on graph neural networks, based on the distributed collaborative defense method for power grids based on graph neural networks as described in any one of claims 1 to 7, characterized in that: It also includes a topology modeling module, used to obtain the power network topology and construct a multi-relationship graph structure; The graph neural network module is used to extract structural features from the multi-relation graph model to obtain local node embeddings and full-graph-level situational embeddings. A centralized evaluation network module is used to evaluate defense strategies based on topological location differentiation. The distributed action execution network module is used to deploy on each node and make defense action decisions based on local characteristics; The training execution management module is used to implement a centralized training and distributed execution mechanism; The feedback iteration module is used to iteratively optimize strategies based on defense execution feedback.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the distributed collaborative defense method for power networks based on graph neural networks as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the distributed collaborative defense method for power networks based on graph neural networks as described in any one of claims 1 to 7.

Images