Adaptive feature fusion intrusion detection method and system for electric power industrial control network

Abstract

The invention provides a self-adaptive feature fusion intrusion detection method and system for an electric power industrial control network, and the method comprises the steps: enabling the generation of a sample to strictly follow the sequential logic of an industrial control protocol through introducing a protocol state perception dynamic sampling mechanism; multi-modal causal feature extraction is adopted, protocol semantics, equipment fingerprints and causal association features are fused, and the feature discrimination ability is effectively improved; designing a federated residual error enhancement fusion model, and realizing safety cooperative training and heterogeneous data adaptation between distributed nodes; and in combination with deep reinforcement learning and transfer learning, constructing a detection parameter dynamic tuning mechanism. According to the method, various attacks such as DoS attacks, protocol forgery and unauthorized access can be accurately identified, the real-time performance of services is guaranteed, meanwhile, the detection precision is remarkably improved, the false alarm rate is reduced, and the method has high environmental adaptability and can be widely applied to electric power industrial control scenes such as transformer substations and dispatching centers.

Description

Technical Field

[0001] This invention relates to the field of power industry control system security technology, and in particular to an adaptive feature fusion intrusion detection method and system for power industrial control networks. Background Technology

[0002] Modern power control systems generally use dedicated protocols such as Modbus-TCP and IEC 60870 to achieve communication between devices. Their communication behavior is characterized by strong timing, multiple states, and strict protocols. However, existing intrusion detection methods still have the following key defects when applied to such scenarios: (1) At the data sampling level, traditional sample augmentation methods (such as SMOTE and ADASYN) do not consider the state transition logic and communication timing constraints of industrial control protocols, resulting in the generated samples not being compliant in actual business, which seriously affects the generalization ability of the model in the actual environment; (2) In terms of feature extraction, existing methods mainly rely on statistical features and linear correlation analysis, failing to effectively integrate discriminative features unique to industrial control systems such as protocol semantics and device fingerprints, and also lack modeling of the causal relationship between features and attack behavior, resulting in a high false alarm rate; (3) At the model architecture level, centralized detection mechanisms are difficult to adapt to the data heterogeneity and communication isolation limitations brought about by multi-node distributed deployments such as substations and dispatch centers, and once the model parameters are fixed, they cannot be dynamically adjusted with the operating environment, resulting in poor system scalability and adaptability; (4) In terms of detection strategies, existing methods are mostly limited to the selection and optimization of protocol types, failing to link model parameters with real-time traffic load and attack status, resulting in slow response and insufficient real-time performance in highly dynamic industrial control environments. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide an adaptive feature fusion intrusion detection method and system for power industrial control networks, so as to systematically solve the shortcomings of existing technologies in terms of sample generation rationality, feature discrimination capability, distributed scalability of models and dynamic adaptability of detection strategies, thereby achieving high-precision, low-false-alarm, and highly adaptive intrusion detection capabilities, and meeting the stringent requirements of power industrial control systems for real-time performance and reliability.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: an adaptive feature fusion intrusion detection method for power industrial control networks, comprising the following steps:

[0005] S1: Protocol State Aware Traffic Preprocessing: Traffic data of Modbus-TCP, IEC 60870-5-104, and IEC 61850 protocols are collected in the power industrial control network. Finite state machines corresponding to each protocol are constructed to divide the session phases. An improved DBSCAN-WGAN hybrid sampling mechanism is used to expand the minority attack samples in each phase. Tomek Links are combined to delete boundary overlapping samples, and then a balanced training set is constructed.

[0006] S2: Multimodal causal feature extraction: Extract protocol semantic features, device fingerprint features and statistical features, use causal discovery algorithms to filter direct causal relationship features, combine Pearson coefficient and heat map to merge redundant features, and finally generate multimodal feature vectors;

[0007] S3: Training of Federated Residual Enhanced Fusion Model: Construct a distributed federated learning architecture, with each node training a local Res-CNN-BiGRU model and the central node aggregating parameters using a federated averaging method; introduce a causal attention layer to enhance the role of key features and output the probability of attack type.

[0008] S4: Deep reinforcement learning adaptive policy optimization: The detection policy is modeled as a Markov decision process, and the DQN algorithm is used to dynamically adjust the model parameters. Combined with transfer learning, the new protocol is quickly adapted, thereby minimizing the detection cost and false alarm rate.

[0009] S5: Intrusion Detection and Alarm: Processes traffic data in real time and inputs it into the trained model. When the probability of an attack category is ≥0.85, an alarm is triggered, and attack details are recorded for traceability and analysis.

[0010] In a preferred embodiment, in step 1, considering the timing characteristics of the power control protocols, a finite state machine (FSM) for each protocol is first constructed, formally defined using a 5-tuple:

[0011]

[0012] Where: S is the set of states Let S be the set of events; T be the state transition function; and S0 be the initial state. Set of terminating states

[0013] State transition determination is achieved by extracting message fields using Deep Packet Analysis (DPI) technology.

[0014] Calculate the percentage of time spent in the state. :

[0015]

[0016] in, Let be the cumulative dwell time in state s, and let be the sum of the dwell times in all states.

[0017] To identify abnormal communication behavior, a state transition probability model is constructed. :

[0018]

[0019] in Indicates from state Transferred to The probability of this number of occurrences is used to identify potential attack patterns. Indicates from state Transferred to Number of times

[0020] To evaluate the rationality of the protocol logic of the synthesized samples, a timing consistency verification index is introduced. :

[0021]

[0022] in The state transition probability for generating samples. represents the state transition probability of the real sample. For the total number of states, when The timing of the synthesized samples is determined to be consistent.

[0023] In a preferred embodiment, step 1 employs an improved DBSCAN-WGAN hybrid sampling mechanism, with the specific steps as follows:

[0024] Step 11: Improve DBSCAN clustering:

[0025] Introducing state weights Construct the weighted Euclidean distance formula :

[0026]

[0027] in Samples In the Feature values ​​in each state; set the neighborhood radius. Minimum number of core points Clustering followed by filtering out minority attack clusters;

[0028] Step 12: WGAN Sample Generation:

[0029] The generator uses an LSTM architecture, and the input noise vector Z~N(0,1) is uniquely encoded with the protocol state. The output is a synthetic sample that conforms to the protocol logic;

[0030] The discriminator is a 3-layer fully connected network, optimized using Wasserstein distance and gradient penalty terms during training.

[0031] The loss function is defined as:

[0032]

[0033]

[0034] The gradient penalty term GP is calculated as follows:

[0035]

[0036]

[0037] The ratio of the number of iterations for the discriminator to the number of iterations for the generator is set to 5:1;

[0038] Step 13: Tomek Links noise reduction:

[0039] Dynamic programming is used to calculate the edit distance between samples:

[0040]

[0041] in For indicator functions, when hour ,otherwise Set the edit distance threshold to 0.1, delete the majority class samples with overlapping boundaries, and finally construct a class-balanced training set with the sample ratio of each class not exceeding 5%.

[0042] In a preferred embodiment, step 2 involves constructing a multimodal feature system, specifically including the extraction and fusion of the following three types of features:

[0043] Step 21: Protocol semantic feature extraction: Train the function code sequence using Word2Vec, set the window size to 5, the dimension to 32, and the number of iterations to 100, and enable Hierarchical Softmax to improve training efficiency; extract 3-gram features from the device address, set the sliding window step size to 1, the feature dimension to 64, and concatenate it with the Word2Vec vector after One-Hot encoding.

[0044] Step 22: Device fingerprint features: Based on the SNMP protocol, use the GetRequest command to read key fields of the device MIB library, including sysDescr, used to extract PLC firmware version information; sysUpTime, used to calculate the device communication cycle; combined with the port scan results, extract the TCP 502 / 102 port access frequency features, and together they form the device fingerprint vector;

[0045] Step 23: Statistical Feature Extraction: Extract 12-dimensional statistical features within the sliding time window, including response delay. Mean and variance; data length The maximum value and median; the coefficient of variation of the message interval;

[0046] Step 24: Causal Feature Filtering and Fusion: A causal graph between features and attack labels is constructed using the PC algorithm, where 0 represents normal, 1 represents DoS, 2 represents protocol forgery, and 3 represents unauthorized access.

[0047] In a preferred embodiment, the specific process of step 24 is as follows:

[0048] Step 241: Conditional Independence Test: Using To determine conditional independence, the significance level is set at α = 0.05. The calculation formula is as follows:

[0049]

[0050] in For the observed values, This is the expected value;

[0051] Step 242: Causality Strength Assessment: Quantifying the causal strength of features and attack labels based on conditional mutual information.

[0052]

[0053] in Representing information entropy while preserving causal strength Direct causal features such as function code anomaly sequences With communication cycle mutation ;

[0054] Step 243: Redundant Feature Elimination: Combining Pearson Coefficient Screen for strongly correlated features and visualize the correlation between features using a heatmap; when the rank correlation coefficient... Principal component analysis (PCA) is used to reduce the dimensionality of redundant features and merge them to ensure that the variance contribution rate of the first principal component is not less than 90%.

[0055] Step 244: Feature Importance Fusion: Introduce SHAP values ​​and perform weighted fusion with causal strength, calculated as follows:

[0056]

[0057] Wherein the fusion coefficient

[0058] Step 245: Multimodal Feature Fusion: An attention mechanism is used to perform weighted fusion of the three types of modal features, as shown in the following formula:

[0059]

[0060]

[0061] in, Indicates the modal type, Here is the modal weight matrix. The corresponding modal feature vectors are used to output a multimodal fusion feature vector with a dimension of 256.

[0062] In a preferred embodiment, step 3 employs a federated learning architecture to implement collaborative detection in a distributed power industrial control scenario. The specific implementation plan is as follows:

[0063] Step 31: Federation System Architecture: Construct a distributed system consisting of 1 central server node and N edge monitoring nodes; establish encrypted communication channels between nodes via the MQTT protocol, use the Paillier homomorphic encryption algorithm to protect the transmission of model parameters, and set the parameter block size to 1024 bytes;

[0064] Step 32: Local Model Structure Design: Each edge node constructs a Res-CNN-BiGRU local model, with the following specific components:

[0065] The Res-CNN module contains two convolutional blocks, each consisting of a 3×1 depthwise separable convolution, a batch normalized layer, and a LeakyReLU activation function. The gradient vanishing problem is mitigated by residual connections F(x)=Conv(Conv(x))+x.

[0066] The BiGRU module contains two hidden layers: a forward GRU to capture historical dependencies and a backward GRU to capture future dependencies, outputting sequence features with a dimension of 128.

[0067] The causal attention layer multiplies the causal graph weight matrix W obtained in stage S2 with the BiGRU output F, and then performs element-wise multiplication after processing with the sigmoid activation function. The calculation formula is as follows:

[0068]

[0069] in The bias vector is initialized using... normal distribution;

[0070] The classification output layer uses the Softmax activation function to output the attack probabilities of four classes, and class weights are introduced into the cross-entropy loss function to balance the sample distribution.

[0071] Step 33: Central Node Aggregation Mechanism: The central node uses a dynamic weighted federated average algorithm to aggregate global parameters.

[0072] Local training setup: Each node uses the Adam optimizer for training and an early stopping mechanism is configured;

[0073] Node Reputation Assessment: Introducing a dynamic reputation mechanism to assess node contributions.

[0074]

[0075] in for Round-time node Credit rating As a contribution reward coefficient, For the local model accuracy of the node, The average accuracy across all nodes. This is the abnormal penalty coefficient. The node data anomaly rate;

[0076] Global parameter aggregation: using a reputation-weighted federated average algorithm.

[0077]

[0078] in, For nodes The sample size, where N represents the total sample size;

[0079] Residual Feature Augmentation: Introducing feature augmentation mechanisms to enhance model expressive power.

[0080]

[0081] in Indicates feature splicing, For the fusion weight matrix;

[0082] Step 34: Model Training and Convergence: The global model parameters are encrypted and then distributed to each node. The system iterates and trains for 50 rounds.

[0083] In a preferred embodiment, in step 4, the intrusion detection strategy is modeled as a Markov Decision Process (MDP), specifically constructed as follows:

[0084] Step A41: State space definition; State space S is quantized and defined as follows: protocol type, traffic load, attack type distribution, and the state vector dimension is 6.

[0085] Step A42: Action space design: Action space A contains 3 adjustable parameters, namely the number of convolutional kernels, the number of attention heads, and the learning rate, for a total of 3×3×3=27 action combinations;

[0086] Step A43: Reward Function Optimization: Adopting a composite reward function:

[0087]

[0088] in, To increase the success rate of detection For false alarm rate, In response to latency, Cost of parameter update , The reward value range is normalized to .

[0089] In a preferred embodiment, step 4, the implementation of the DQN algorithm employs a deep Q-network training strategy, specifically including:

[0090] Step B41: Experience replay mechanism: Priority sampling is adopted, and the sample priority is defined as follows:

[0091]

[0092] in , The value increases linearly from 0.4 to 1.0 with each training round; the replay pool capacity is set to 10,000, and the batch size for each sampling is 64.

[0093] Step B42: Network Structure and Training: The policy network adopts a 3-layer fully connected structure, and the activation function is ReLU; the target network maintains the same structure as the policy network, and the parameters are synchronized every 10 rounds; the training process uses... A greedy strategy is employed, using Huber loss as the loss function to mitigate the impact of outliers.

[0094] Step B43: Adaptive Strategy Adjustment: Introduce a load adaptation coefficient: in For the current traffic load, =1000, =5000, =0.5 is the load impact coefficient, and the policy update step size is...

[0095] In a preferred embodiment, step 4, rapid adaptation through transfer learning, specifically refers to rapid adaptation for a new protocol, and includes the following steps:

[0096] Step C41: Transfer weight calculation: Parameter update based on protocol feature similarity: in For pre-trained model parameters, These are the parameters for the current new model. These are the parameters after fine-tuning. For protocol features, cosine similarity For migration weights;

[0097] Step C42: Transfer conditions and fine-tuning strategy: Enable transfer learning when the cosine similarity between the new protocol and the pre-trained protocol is ≥0.7; freeze the Res-CNN-BiGRU feature extraction layer and only fine-tune the causal attention layer and classification layer; adopt learning rate decay: initially 0.001, decay to 1 / 10 every 3 rounds; train the system iteratively for 1000 rounds, and the convergence criterion is an average reward ≥0.85.

[0098] The present invention also provides an adaptive feature fusion intrusion detection system for power industrial control networks, comprising a processor, a memory and a bus, wherein the memory stores machine-readable instructions executed by the processor;

[0099] When the system is running, the processor and the memory communicate via a bus, and the machine-readable instructions are executed by the processor as described in the adaptive feature fusion intrusion detection method for power industrial control networks.

[0100] Compared with the prior art, the present invention has the following beneficial effects:

[0101] 1. Strong protocol adaptability: Through the protocol state-aware dynamic sampling mechanism, the generated samples strictly follow the timing logic and state transition rules of the industrial control protocol, effectively improving sample compliance and model generalization ability.

[0102] 2. Outstanding feature discrimination capability: The multimodal feature extraction mechanism, which integrates device fingerprints, protocol semantics and causal features, can effectively eliminate the interference of non-causal features and improve the quality of feature discrimination.

[0103] 3. High efficiency of distributed collaboration: The federated learning architecture avoids data privacy leaks and adapts to heterogeneous data from multiple sites.

[0104] 4. Rapid Response with Dynamic Strategy: A deep reinforcement learning mechanism is introduced to dynamically optimize detection parameters based on real-time traffic load and attack status, significantly improving response speed. This meets the stringent requirements of millisecond-level real-time detection in power industrial control scenarios. Attached Figure Description

[0105] Figure 1 This is a preferred embodiment of the present invention. Figure 1 This is an overall flowchart of the method of the present invention;

[0106] Figure 2 This is a heatmap and correlation analysis diagram of the PHM feature extraction module of the present invention;

[0107] Figure 3 A schematic diagram of the network structure of the fusion model of this invention is shown;

[0108] Figure 4 The diagram presents a comparison of the detection performance of this invention on a power industrial control dataset;

[0109] Figure 5 A diagram showing the comparison of sample size before and after data preprocessing is provided.

[0110] Figure 6 The diagram illustrates the variation in the detection success rate of the adaptive strategy using a broken line. Detailed Implementation

[0111] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0112] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0113] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0114] An adaptive feature fusion intrusion detection method for power industrial control networks, referenced Figure 1-6 This includes the following steps:

[0115] S1: Protocol State Aware Traffic Preprocessing

[0116] To address the timing characteristics of power control protocols, a finite state machine (FSM) for each protocol is first constructed, formally defined using a 5-tuple:

[0117]

[0118] Where: S is a set of states, for example, defined in Modbus-TCP as { Connection established. Request to send, : Response received Abnormal disconnection, :idle}; For a collection of events, such as { TCP SYN packet, Function code 0x03 request, The response code is 0x83. :TCP RST packet}; T is the state transition function, for example This indicates that after the connection is established, the state transitions to the request sending state upon receiving a request packet. Initial state ; For the set of terminating states ({ , }).

[0119] State transition determination is implemented by extracting message fields using Deep Packet Analysis (DPI) technology. For example, a transition is triggered when function code 0x83 is detected and the TCP RST flag is set. .

[0120] To characterize the importance of each state in the communication process, the percentage of time spent in each state is calculated:

[0121]

[0122] in, Let be the cumulative dwell time in state s, and the denominator be the sum of the dwell times in all states. For example, in the "request-response" phase, and percentage It can reach 0.6; while in the "abnormal reconnection" phase, percentage It is 0.2.

[0123] Furthermore, to identify abnormal communication behavior, a state transition probability model is constructed:

[0124]

[0125] in Indicates from state Transferred to The number of times this probability is used to identify potential attack patterns, such as when... The time marker is used as a precursor to a potential attack.

[0126] To evaluate the rationality of the protocol logic of the synthesized samples, a timing consistency verification index is introduced:

[0127]

[0128] in The state transition probability for generating samples. represents the state transition probability of the real sample. For the total number of states, when The timing of the synthesized samples is determined to be consistent.

[0129] An improved DBSCAN-WGAN hybrid sampling mechanism is adopted, and the specific steps are as follows:

[0130] (1) Improved DBSCAN clustering:

[0131] Introducing state weights Construct the weighted Euclidean distance formula:

[0132]

[0133] in Samples In the Feature values ​​in each state; set the neighborhood radius. (Determined by the elbow rule) Minimum number of core points (Adaptively adjusted based on sample density), minority attack clusters are selected after clustering;

[0134] (2) WGAN sample generation:

[0135] The generator uses an LSTM architecture with an input dimension of 128 and 64 hidden layers. Input noise vector Unique encoding with protocol state (e.g.) Encoded as The output is a synthetic sample that conforms to the protocol logic;

[0136] The discriminator is a 3-layer fully connected network with hidden layer dimensions of 128 and 64, respectively, and uses Wasserstein distance and gradient penalty terms. Optimize training,

[0137] The loss function is defined as:

[0138]

[0139]

[0140] The gradient penalty term GP is calculated as follows:

[0141]

[0142]

[0143] The ratio of discriminator to generator iterations was set to 5:1 to stabilize training and avoid pattern collapse.

[0144] (3) Tomek Links noise reduction:

[0145] Dynamic programming is used to calculate the edit distance between samples:

[0146]

[0147] in For indicator functions, when hour ,otherwise Set the edit distance threshold to 0.1, delete the majority class samples with overlapping boundaries, and finally construct a class-balanced training set with the sample ratio of each class not exceeding 5%.

[0148] S2: Multimodal Causal Feature Extraction

[0149] Constructing a multimodal feature system specifically includes the extraction and fusion of the following three types of features:

[0150] (1) Semantic feature extraction of the protocol: Word2Vec training is performed on the function code sequence (e.g., 0x03, 0x06, 0x83), with a window size of 5, a dimension of 32, and an iteration count of 100. Hierarchical Softmax is enabled to improve training efficiency. 3-gram features are extracted from the device address (e.g., 192.168.1.101), with a sliding window step size of 1 and a feature dimension of 64. After One-Hot encoding, the features are concatenated with the Word2Vec vector.

[0151] (2) Device fingerprint features: Based on the SNMP protocol, the GetRequest command is used to read key fields of the device MIB library, including sysDescr (OID: 1.3.6.1.2.1.1.1), which is used to extract PLC firmware version information; sysUpTime (OID: 1.3.6.1.2.1.1.3), which is used to calculate the device communication cycle; combined with the port scan results, the TCP 502 / 102 port access frequency features are extracted and together constitute the device fingerprint vector.

[0152] (3) Statistical feature extraction: 12-dimensional statistical features, including response delay, are extracted within a sliding time window (window size 10 seconds, step size 5 seconds). Mean and variance; data length The maximum value and median; the coefficient of variation of the message interval, etc.

[0153] Causal Feature Filtering and Fusion: A causal graph between features and attack labels (0: normal, 1: DoS, 2: protocol forgery, 3: unauthorized access) is constructed using the PC algorithm. The specific process is as follows:

[0154] (1) Conditional independence test: using To determine conditional independence, the significance level is set at α = 0.05. The calculation formula is as follows:

[0155]

[0156] in For the observed values, This is the expected value.

[0157] (2) Causal strength assessment: Causal strength based on conditional mutual information quantification features and attack tags:

[0158]

[0159] in Representing information entropy while preserving causal strength Direct causal features such as function code anomaly sequences With communication cycle mutation wait;

[0160] (3) Redundancy elimination: combined with Pearson coefficient Select strongly correlated features and visualize the correlation between features using a heatmap. When the rank correlation coefficient... Principal component analysis (PCA) is used to reduce the dimensionality of redundant features (e.g., merging "mean response delay" and "message interval variance" into the first principal component) to ensure that the variance contribution rate of the first principal component is not less than 90%.

[0161] (4) Feature Importance Fusion: The SHAP value is introduced and weighted with causal strength for fusion, and the calculation is as follows:

[0162]

[0163] Wherein the fusion coefficient Experimental verification The optimal effect is achieved by retaining the top 80% of features by importance.

[0164] (5) Multimodal feature fusion: The attention mechanism is used to perform weighted fusion of the three types of modal features, as shown in the following formula:

[0165]

[0166]

[0167] in, Indicates modality type (semantic / fingerprint / statistical). Here is the modal weight matrix. The corresponding modal feature vectors are used to output a multimodal fusion feature vector with a dimension of 256.

[0168] S3: Training of the Federated Residual Enhancement Fusion Model

[0169] A federated learning architecture is adopted to implement collaborative detection in a distributed power industrial control scenario. The specific implementation plan is as follows:

[0170] (1) Federated system architecture: Construct a distributed system consisting of one central server node and N edge monitoring nodes (deployed in substations, dispatch centers, etc.). Nodes establish encrypted communication channels through the MQTT protocol (port 1883), and use the Paillier homomorphic encryption algorithm (key length 2048 bits) to protect the transmission of model parameters. The parameter block size is set to 1024 bytes.

[0171] (2) Local model structure design: Each edge node constructs a Res-CNN-BiGRU local model, with the following specific components:

[0172] The Res-CNN module contains two convolutional blocks, each consisting of a 3×1 depthwise separable convolution (64 output channels, stride 1, padding "same"), a batch normalization layer, and a LeakyReLU activation function. Composition, through residual connection Mitigating the vanishing gradient problem;

[0173] The BiGRU module contains two hidden layers (64 neurons per layer). The forward GRU captures historical dependencies, and the backward GRU captures future dependencies, outputting sequence features with a dimension of 128.

[0174] The causal attention layer multiplies the causal graph weight matrix W (128×128 dimension) obtained in stage S2 with the BiGRU output F, and then performs element-wise multiplication after processing with the sigmoid activation function. The calculation formula is as follows:

[0175]

[0176] in The bias vector is initialized using... normal distribution;

[0177] The classification output layer uses the Softmax activation function to output the attack probabilities of four classes. The cross-entropy loss function introduces class weights (minority class weight is set to 2.0) to balance the sample distribution.

[0178] (3) Central node aggregation mechanism: The central node uses a dynamic weighted federated average algorithm to aggregate global parameters.

[0179] Local training setup: Each node is trained using the Adam optimizer (initial learning rate). Training is performed with an early stopping mechanism (training stops when the loss function decreases to less than 0.001 for 5 consecutive rounds).

[0180] Node Reputation Assessment: Introducing a dynamic reputation mechanism to assess node contributions.

[0181]

[0182] in for Round-time node Credit rating Contribution reward coefficient, For the local model accuracy of the node, The average accuracy across all nodes. This is the abnormal penalty coefficient. For node data anomaly rate (such as sample distribution bias) hour Otherwise );

[0183] Global parameter aggregation: using a reputation-weighted federated average algorithm.

[0184]

[0185] in, For nodes The sample size, where N represents the total sample size;

[0186] Residual Feature Augmentation: Introducing feature augmentation mechanisms to enhance model expressive power.

[0187]

[0188] in Indicates feature splicing, For the fusion weight matrix;

[0189] (4) Model Training and Convergence: The global model parameters are encrypted and distributed to each node. The system undergoes 50 rounds of iterative training. The model convergence criterion is: the accuracy on the validation set increases by less than 0.1% for three consecutive rounds and... .

[0190] S4: Deep Reinforcement Learning Adaptive Policy Optimization

[0191] The intrusion detection strategy is modeled as a Markov Decision Process (MDP), specifically constructed as follows:

[0192] (1) Definition of state space: The state space S is defined as follows: protocol type (Modbus=1, IEC 60870=2, IEC61850=3), traffic load (low <1000pps=1, medium 1000-5000pps=2, high >5000pps=3), attack type distribution (DoS ratio, protocol forgery ratio, unauthorized access ratio), and the state vector dimension is 6;

[0193] (2) Action space design: Action space A contains 3 adjustable parameters, namely the number of convolution kernels (32=1, 64=2, 128=3), the number of attention heads (2=1, 4=2, 8=3), and the learning rate (0.0001=1, 0.001=2, 0.01=3), for a total of 3×3×3=27 action combinations;

[0194] (3) Optimization of reward function: A composite reward function is adopted:

[0195]

[0196] in, To improve the success rate (accuracy) of detection Recall rate For false alarm rate, Response time (unit: ms) Cost of parameter update (when the number of convolutional kernels is 128) When it is 64, When it is 32, ), , The reward value range is normalized to .

[0197] DQN algorithm implementation: A deep Q-network training strategy is adopted.

[0198] (1) Experience playback mechanism: Priority sampling is adopted, and the sample priority is defined as:

[0199]

[0200] in , The value increases linearly from 0.4 to 1.0 with each training round; the replay pool capacity is set to 10,000, and the batch size for each sampling is 64.

[0201] (2) Network Structure and Training: The policy network adopts a 3-layer fully connected structure (input dimension 6, hidden layer dimension 64, output dimension 27), and the activation function is ReLU; the target network and policy network have the same structure, and the parameters are synchronized every 10 rounds; the training process adopts... Greedy strategy ( The loss function is linearly reduced from 0.9 to 0.1 (at a rate of 0.001 per round). The Huber loss function is used to reduce the impact of outliers.

[0202] (3) Adaptive strategy adjustment: Introduce a load adaptive coefficient: in For the current traffic load, =1000, =5000, =0.5 is the load impact coefficient, and the policy update step size is... ;

[0203] Transfer learning for rapid adaptation: rapid adaptation to new protocols.

[0204] (1) Calculation of migration weights: Parameter update based on protocol feature similarity: in For pre-trained model parameters, These are the parameters for the current new model. These are the parameters after fine-tuning. For protocol features, cosine similarity For migration weights;

[0205] (2) Transfer conditions and fine-tuning strategy: Transfer learning is enabled when the cosine similarity between the new protocol and the pre-trained protocol is ≥0.7; the Res-CNN-BiGRU feature extraction layer is frozen, and only the causal attention layer and classification layer are fine-tuned; the learning rate decay is adopted: initially 0.001, decaying to 1 / 10 every 3 rounds; after 10-15 rounds of fine-tuning, the detection accuracy can be ≥98.5%.

[0206] The system underwent 1000 rounds of iterative training, with a convergence criterion of an average reward ≥ 0.85. This scheme achieves dynamic optimization of the detection strategy and rapid adaptation to new protocols, significantly improving the system's environmental adaptability and real-time performance.

[0207] Experimental Environment and Dataset

[0208] Experimental environment: CPU: Intel Xeon E5-2680 v4, GPU: NVIDIA Tesla V100, RAM: 64GB, Operating System: Ubuntu 18.04, Deep Learning Framework: TensorFlow 2.8.0. See Table 1 for detailed experimental environment parameters.

[0209] Table 1: Experimental Environmental Parameters

[0210]

[0211] Dataset: The dataset used is the industrial control network traffic dataset of a substation of a provincial power company, which includes 200,000 normal traffic entries, 12,000 DoS attack entries, 8,000 protocol forgery entries, and 5,000 unauthorized access entries. The publicly available dataset NSL-KDD is used for comparison. See Table 2 for details of the dataset composition.

[0212] Table 2: Composition of the experimental dataset

[0213]

[0214] Data preprocessing

[0215] After collecting substation traffic data, the Modbus-TCP protocol function codes (e.g., 0x03, 0x06), response latency (range 0-500ms), data length (range 8-1024 bytes), and fields such as the call command frame and link address of the IEC 60870-5-104 protocol were extracted. The function codes were one-hot encoded (dimension 16), and the response latency and data length were normalized to [0,1] using Min-Max. Attack samples were generated using ADASYN, increasing the number of minority 'unauthorized access' samples from 5,000 to 15,000. After removing 3,200 overlapping samples using Tomek Links, the final training set contained 200,000 normal traffic samples and 31,800 attack traffic samples, with a more balanced class distribution. The change in the number of samples before and after data preprocessing is shown in the figure. Figure 5 As shown:

[0216] Figure 5 This chart compares the number of samples before and after data preprocessing. The horizontal axis of the bar chart represents the sample category (normal traffic, DoS attack, protocol spoofing, unauthorized access), and the vertical axis represents the number of samples (unit: records). Blue bars represent the number of samples before preprocessing, and orange bars represent the number of samples after preprocessing. Specific numerical values ​​are labeled above each bar, clearly showing the change in the number of samples in each category during preprocessing. In particular, the "unauthorized access" category increased from 5,000 records before preprocessing to 13,500 records after expansion and noise reduction. A legend is placed below the chart to clearly distinguish the data state before and after preprocessing.

[0217] This embodiment effectively solves the problems of feature heterogeneity and sample imbalance in the original data through the system's data preprocessing process, providing a high-quality data foundation for subsequent model training.

[0218] Model training and performance testing

[0219] The training parameters for the fusion model are as follows: the Adam optimizer is used, the initial learning rate is set to 0.001, the batch size is 256, the number of epochs is 50, and the cross-entropy loss function is selected. During training, the model's accuracy on the validation set converged to 99.4% at the 35th iteration.

[0220] Performance test results: On the substation dataset, the proposed method achieved an accuracy of 99.3%, precision of 99.2%, recall of 99.4%, and an F1-score of 99.3%. Compared to the traditional CNN-LSTM model, the accuracy is improved by 2.1%, and the false positive rate is reduced by 1.5%. Compared to the XGBoost model, the F1-score is improved by 4.8%. To verify the generalization ability of the method, tests were conducted on the standard NSL-KDD dataset, achieving an accuracy of 99.6%, which is superior to the Transformer+CNN+LSTM model (98.45%). These results verify that the present invention, by introducing protocol state-aware sampling, multimodal causal feature fusion, and federated residual enhancement mechanisms, can effectively maintain high detection accuracy while significantly improving the model's adaptability to power industrial control scenarios. In particular, the use of deep separable convolution and causal attention mechanisms effectively enhances the model's ability to represent protocol semantic features, providing technical assurance for accurately identifying various attack behaviors. See Table 3 for detailed performance comparisons of each model, which clearly demonstrates the comprehensive advantages of the proposed method across multiple evaluation metrics.

[0221] Table 3: Model Performance Comparison Table

[0222]

[0223] Adaptive policy verification

[0224] After deploying this method on three different network segments in the substation, the detection performance of each protocol was recorded: the success rate for the Modbus-TCP network segment was 98.5%, with a response latency of 120ms; the success rate for the IEC 60870 network segment was 99.2%, with a latency of 80ms; and the success rate for the IEC 61850 network segment was 97.8%, with a latency of 150ms. The UCB algorithm prioritized the IEC 60870 protocol combination, thereby improving the overall detection efficiency by 32% compared to the fixed strategy. When the success rate of a network segment dropped to 58% due to protocol upgrades, the system automatically loaded the new protocol template and restored the detection success rate to 97.2% within 10 minutes.

[0225] Adaptive strategy optimization effect such as Figure 6 As shown.

Claims

1. An adaptive feature fusion intrusion detection method for power industrial control network, characterized in that, The method comprises the following steps: S1: protocol state-aware traffic preprocessing: collecting traffic data of Modbus-TCP, IEC 60870-5-104 and IEC 61850 protocols in the power industrial control network, constructing a finite state machine corresponding to each protocol to divide the session stage; using an improved DBSCAN-WGAN hybrid sampling mechanism to expand the minority class attack samples in each stage, combining Tomek Links to delete the boundary overlapping samples, and then constructing a balanced training set; S2: multi-modal causal feature extraction: extracting protocol semantic features, device fingerprint features and statistical features, using a causal discovery algorithm to screen direct causal relationship features, combining the Pearson coefficient and a heat map to merge redundant features, and finally generating a multi-modal feature vector; S3: federated residual enhancement fusion model training: constructing a distributed federated learning architecture, training a Res-CNN-BiGRU local model at each node, and using a federated average method to aggregate parameters at the center node; introducing a causal attention layer to strengthen the role of key features, and outputting attack type probability; S4: deep reinforcement learning adaptive strategy optimization: modeling the detection strategy as a Markov decision process, dynamically adjusting model parameters using the DQN algorithm, and combining transfer learning to achieve rapid adaptation to new protocols, thereby minimizing detection cost and false alarm rate; S5: intrusion judgment and alarm: real-time processing of traffic data and inputting the traffic data into the trained model, triggering an alarm when the attack category probability is greater than or equal to 0.85, and recording attack details for traceability analysis.

2. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 1, according to the time sequence characteristics of the power industrial control protocol, first, a finite state machine FSM of each protocol is constructed, which is defined in a five-tuple form as follows: wherein: S is a set of states; is a set of events; T is a state transition function; is an initial state; is a set of terminal states; The state transition is determined based on the extracted message fields by using a deep packet inspection (DPI) technology; Computing state residence time proportion : wherein, is the accumulated residence time for state s, and the denominator is the sum of residence times for all states. To identify abnormal communication behavior, a state transition probability model is constructed : wherein denotes the number of times the state is transferred to , the probability being used to identify potential attack patterns, denotes the number of times the state is transferred to ; To evaluate the protocol logic rationality of the synthetic sample, a timing consistency check index is introduced : wherein is the state transition probability of the generated sample, is the state transition probability of the real sample, is the total number of states, when the synthetic sample is determined to be consistent in timing.

3. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 2, characterized in that, In step 1, an improved DBSCAN-WGAN hybrid sampling mechanism is used, and the specific steps are as follows: Step 11: improved DBSCAN clustering: Introducing state weights , constructing a weighted Euclidean distance formula : wherein are the sample characteristic values in the first state; the neighborhood radius is set , the minimum core point number , and the minority class attack cluster is screened after clustering; Step 12: WGAN sample generation: The generator adopts LSTM architecture, input noise vector With protocol state unique coding, output is a synthetic sample that conforms to the protocol logic; The discriminator is a 3-layer fully connected network, and the Wasserstein distance and gradient penalty term are used for optimization training, The loss function is defined as: Where the gradient penalty term GP is calculated as: The iteration ratio of the discriminator to the generator is set to 5:1; Step 13: Tomek Links denoising: The edit distance between samples is calculated by dynamic programming: wherein is an indicator function, when , otherwise ; set the edit distance threshold value 0.1, delete the majority class samples with boundary overlap, and finally construct a class-balanced training set, with the deviation of the proportion of each class sample not exceeding 5%.​ 4. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 2, a multi-modal feature system is constructed, which specifically includes the extraction and fusion of the following three types of features: Step 21: protocol semantic feature extraction: Word2Vec training is performed on the function code sequence, the window size is set to 5, the dimension is set to 32, the number of iterations is set to 100, and the Hierarchical Softmax is enabled to improve the training efficiency; 3-gram features are extracted for the device address, the sliding window step is set to 1, and the feature dimension is set to 64; after One-Hot encoding, the vector is spliced with the Word2Vec vector; Step 22: device fingerprint feature: based on the SNMP protocol, the GetRequest command is used to read the key fields of the device MIB library, including sysDescr, which is used to extract the PLC firmware version information; sysUpTime, used to calculate the device communication period; combined with the port scanning results, the TCP 502 / 102 port access frequency characteristics are extracted to form a device fingerprint vector together; Step 23: Statistical feature extraction: 12-dimensional statistical features are extracted within the sliding time window, including mean and variance of response delay ; maximum and median of data length ; coefficient of variation of packet interval; Step 24: Causal feature screening and fusion: PC algorithm is used to construct the causal graph between features and attack labels, where 0 represents normal, 1 represents DoS, 2 represents protocol spoofing, and 3 represents unauthorized access.

5. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 4, characterized in that, The specific process of step 24 is as follows: Step 241: Conditional independence test: use statistic to determine conditional independence, with a significance level of a = 0.05, and the formula is: wherein is the observed value, is the expected value; Step 242: Causal strength evaluation: Based on conditional mutual information, the causal strength of features and attack labels is quantified: wherein represents information entropy, preserving causal strength direct causal features such as functional code abnormal sequences with communication period mutation ; Step 243: Redundant feature elimination: Incorporating Pearson Coefficient Strongly correlated features are screened and the correlation between features is visualized through a heatmap; When the rank correlation coefficient The redundant features are reduced and combined by principal component analysis (PCA) to ensure that the variance contribution rate of the first principal component is not less than 90%. Step 244: Feature importance fusion: SHAP value is introduced and weighted fusion is performed with causal strength, calculated as follows: wherein the fusion coefficient ; Step 245: Multi-modal feature fusion: Attention mechanism is used to weight and fuse the three types of modal features, as follows: wherein, denotes the modal type, is the modal weight matrix, is the corresponding modal feature vector, and the final output dimension is a 256-dimensional multi-modal fusion feature vector.

6. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 3, a federated learning architecture is used to realize collaborative detection in distributed power industrial control scenarios, and the specific implementation scheme is as follows: Step 31: Federated system architecture: A distributed system is constructed, which includes 1 central server node and N edge monitoring nodes; encrypted communication channels are established between nodes through MQTT protocol, Paillier homomorphic encryption algorithm is used to protect model parameter transmission, and parameter block size is set to 1024 bytes; Step 32: Local model structure design: Each edge node constructs a Res-CNN-BiGRU local model, which consists of the following components: The Res-CNN module comprises two convolution blocks, each of which is composed of a 3x1 depth separable convolution, a batch normalization layer and a LeakyReLU activation function, and is connected through a residual connection alleviate the gradient vanishing problem; The BiGRU module contains 2 layers of hidden layers, the forward GRU captures historical dependency, the backward GRU captures future dependency, and the output dimension is a sequence of features with a dimension of 128; The causal attention layer multiplies the causal graph weight matrix W obtained in S2 stage and the BiGRU output F, and then performs element-wise multiplication after sigmoid activation function processing, with the calculation formula as follows: wherein is the bias vector, initialized with a normal distribution; The classification output layer uses Softmax activation function to output 4-class attack probability, and class weight is introduced in cross-entropy loss function to balance sample distribution; Step 33: Central node aggregation mechanism: The central node uses dynamic weighted federated averaging algorithm for global parameter aggregation; Local training settings: Each node uses Adam optimizer for training, with early stopping mechanism; Node reputation evaluation: Dynamic reputation mechanism is introduced to evaluate node contribution: wherein is wheel time node the reputation coefficient of the node, is the contribution reward coefficient, is the node local model accuracy, is the average accuracy of all nodes, is the abnormal penalty coefficient, is the node data anomaly rate; Global parameter aggregation: Reputation-weighted federated averaging algorithm is used: wherein is the sample size of the node N represents the total sample size; Residual feature enhancement: Feature enhancement mechanism is introduced to improve model expression ability: wherein denotes feature concatenation, is a fusion weight matrix; Step 34: Model training and convergence: Global model parameters are distributed to each node after encryption, and the system iteratively trains for 50 rounds.

7. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 4, the intrusion detection strategy is modeled as a Markov decision process (MDP), and the specific construction is as follows: Step A41: State space definition; State space S is quantitatively defined: protocol type, traffic load, attack type distribution, state vector dimension is 6; Step A42: Action space design: Action space A contains 3 adjustable parameters, namely convolution kernel number, attention head number, and learning rate, with 3x3x3=27 action combinations; Step A43: Reward function optimization: Compound reward function is used: wherein, is a detection success rate, is a false positive rate, is a response latency, is a parameter update cost, , reward value range is normalized to .

8. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 4, the DQN algorithm is implemented using a deep Q network training strategy, which specifically includes: Step B41: Experience replay mechanism: priority sampling is adopted, and the sample priority is defined as: wherein , from 0.4 linearly growing with training epochs to 1.0; replay buffer capacity set to 10000, batch size per sample 64; Step B42: Network structure and training: the policy network adopts a 3-layer fully connected structure, and the activation function is ReLU; the target network and the policy network have the same structure, and the parameters are synchronized once every 10 rounds; the training process adopts the greedy strategy, and the loss function adopts Huber loss to reduce the influence of outliers; Step B43: Adaptive policy adjustment: Introduce load adaptive coefficient: wherein is the current traffic load, = 1000, = 5000, = 0.5 is the load influence coefficient, and the policy update step size is .

9. The adaptive feature fusion intrusion detection method for power industrial control network according to claim 1, characterized in that, In step 4, the fast adaptation of transfer learning is specifically the fast adaptation of the new protocol, and specifically includes the following steps: Step C41: Migration weight calculation: parameter update based on protocol feature similarity wherein is the pre-trained model parameter, is the current new model parameter, is the fine-tuned parameter, is the protocol feature cosine similarity, is the migration weight; Step C42: Transfer condition and fine-tuning strategy: when the cosine similarity between the new protocol and the pre-training protocol is greater than or equal to 0.7, the transfer learning is enabled. Freezing the Res-CNN-BiGRU feature extraction layer, only fine-tuning the causal attention layer and the classification layer; Learning rate decay is adopted: initial 0.001, decay to 1 / 10 every 3 rounds; The system iteratively trains 1000 rounds, and the convergence standard is that the average reward is greater than or equal to 0.

85.

10. An adaptive feature fusion intrusion detection system for a power industrial control network, comprising a processor, a memory and a bus, the memory storing machine readable instructions executed by the processor; characterized in that, When the system is running, the processor and the memory communicate through the bus, and the machine readable instructions are executed by the processor to perform the adaptive feature fusion intrusion detection method for the power industrial control network as claimed in any one of claims 1 to 9.

Images