Autonomous controllable embedded operating system flow monitoring method for power business

Abstract

The invention relates to an autonomous controllable embedded operating system flow monitoring method for power business. The method comprises the following steps: S1, capturing communication flow data of an industrial protocol in real time; s2, according to the communication flow data, the cloud end detects distributed denial of service attacks, port scanning, illegal instruction injection and data leakage attacks for the power control system in real time by analyzing a space-time interaction mode between devices based on an ST-GAT model; and S3, integrating a lightweight LAKE protocol on intelligent electronic equipment running an autonomous controllable operating system to realize encrypted data transmission, and establishing an end-to-cloud secure communication link in a resource-constrained environment. According to the method, real-time efficient acquisition and end-to-end encryption of the network traffic of the power terminal are realized, and various potential risks and attack behaviors can be intelligently identified through global modeling of network communication behaviors.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of system monitoring, in particular to a self-controllable embedded operating system traffic monitoring method for power business. BACKGROUND

[0002] With the acceleration of the digital transformation of the power industry, key infrastructures such as power automation control systems, smart substations and distribution terminal units are connected to the Internet of Things and the Energy Internet, and the network communication environment is becoming increasingly complex. The power business system not only carries out large-scale real-time data interaction, but also needs to ensure the continuous and stable operation of key business, so it faces growing network attack risks and data security challenges. Especially under the background of smart grid construction, how to realize intelligent monitoring and security protection of power business full-link traffic has become a core requirement to ensure the safe and reliable operation of the power system.

[0003] The self-controllable capability has become an important foundation for the construction of the network security system in the power industry. Under the current international situation and the background of industrial upgrading, the process of localization substitution is accelerating, and the demand for self-controllable embedded operating systems and self-produced security protocols in the power industry is increasingly urgent. The introduction of a self-controllable bottom platform not only effectively prevents potential threats from "black box" systems, but also builds a secure and reliable, controllable power monitoring system. Traditional network security protection methods gradually fail in complex and distributed power scenarios and are difficult to cope with diversified and covert network threats. SUMMARY

[0004] To solve the above problems, the purpose of the present application is to provide a self-controllable embedded operating system traffic monitoring method for power business, which not only realizes real-time and efficient collection of power terminal network traffic and end-to-end encryption, but also intelligently identifies various potential risks and attack behaviors through global modeling of network communication behavior.

[0005] To achieve the above purpose, the present application adopts the following technical solutions:

[0006] The self-controllable embedded operating system traffic monitoring method for power business comprises the following steps:

[0007] S1: Real-time capture of industrial protocol communication traffic data through embedded collectors deployed in substation IED devices, regional terminal units and master control centers;

[0008] S2: Based on the communication traffic data, the cloud analyzes the space-time interaction mode between devices based on the ST-GAT model to detect distributed denial of service attacks, port scanning, illegal instruction injection and data leakage attacks against power control systems in real time;

[0009] S3: On intelligent electronic devices running an autonomous and controllable operating system, a lightweight LAKE protocol is integrated to achieve encrypted data transmission, establishing a secure end-to-cloud communication link in resource-constrained environments.

[0010] Furthermore, the communication traffic data is transformed into a dynamic graph representation. Within a time period... The communication traffic within is defined as a dynamic graph snapshot sequence. The topology of the graph changes at different time steps; at each time step Build a graph ,in: It is a set of nodes, representing all active communication devices in the power grid, each uniquely identified by its IP address; For the edge in the time window Inside, if the equipment With equipment If communication occurs between them, then there exists an edge in the graph. ; For node characteristics, each node eigenvectors It is derived from the statistical analysis of the metadata that is observable within that time window; The edge feature is defined as follows.

[0011] Furthermore, the ST-GAT model consists of a spatial feature extraction module GAT, a temporal feature extraction module GRU, and a reconstruction decoder.

[0012] Furthermore, the spatial feature extraction module is as follows:

[0013] For each time step The picture It employs an edge-aware graph attention network to learn the context-aware representation of each node; through a self-attention mechanism, it can dynamically assign different importance weights to the neighbors of each node; for nodes... In its first The update process of layer GAT is as follows: First, compute nodes... with his neighbors Attention coefficient between This coefficient takes into account the characteristics of the source node, the target node, and the edges connecting them:

[0014]

[0015] in and These are the source nodes. and its neighboring nodes In the feature representation of the previous layer It is a feature representation of the edges connecting them; and It is a learnable linear transformation matrix used to project the features of nodes and edges onto a unified feature space; the symbol || represents the concatenation operation, merging the three transformed feature vectors into a single long vector; and This is the transpose of a learnable weight vector;

[0016] Then, the attention coefficients of all neighbors are normalized using the softmax function to obtain the attention weights. :

[0017] ;

[0018] Finally, the node is updated by weighted summation of the features of its neighbors. The representation of:

[0019]

[0020] in It is a non-linear activation function;

[0021] A multi-head attention mechanism was adopted, in all After calculating the weighted features of each node, their results are concatenated to form the final node output feature of that layer. The final node representation update formula is as follows:

[0022]

[0023] in It is the first Normalized attention weights calculated from each attention head. It is the corresponding linear transformation matrix, and || represents the concatenation operation.

[0024] Furthermore, the time feature extraction module is as follows:

[0025] Based on the output of the spatial feature extraction module, at each time step All for each node We obtain an embedding vector rich in contextual information. The embedding sequence of each node is input into a gated recurrent unit network.

[0026] The time feature extraction module at the time step The state update process is as follows, all of which are in the formula. , Matrix and The vectors are all learnable parameters independent of the temporal feature extraction module and are not shared with the parameters in the temporal feature extraction module.

[0027] (1) Reset the door :

[0028] ;

[0029] Input at the current moment Compared to the previous hidden state Combined and activated by a sigmoid function; when When an element is close to 0, it means that the model will ignore the information of the corresponding dimension when calculating the next candidate state; conversely, when it is close to 1, it means that it will be completely retained.

[0030] (2) Update the door :

[0031] ;

[0032] The function of the update gate is to control the state information of the previous moment. How many are directly incorporated into the final state at the current moment? middle;

[0033] (3) Candidate hidden state :

[0034] ;

[0035] Used reset door The output is used to control the inflow of historical information. This represents element-wise product, combined with the current input. To generate new candidate memories; The tanh activation function;

[0036] (4) Final hidden state :

[0037] ;

[0038] Finally, the model updates the gates. To linearly interpolate and combine the old hidden states and new candidate hidden states The first part of the formula (1- ) The second part determines how many old memories to retain. It determines the amount of new information absorbed.

[0039] Furthermore, the training objective of the ST-GAT model is to minimize the reconstruction error on normal data.

[0040] For each node At time step abnormal scores It can be defined as the L2 norm of its feature reconstruction error:

[0041] :

[0042] A dynamic threshold selection strategy based on extremum theory, namely the peak thresholding algorithm, is adopted:

[0043] (1) Screening extreme values: from the normal reconstruction error over a period of time Choose a higher initial quantile as the threshold. Only focus on values ​​exceeding this initial threshold. The error value, i.e., the peak value;

[0044] (2) Fitting extreme value distribution: For these peak values ​​that exceed the initial threshold Modeling is performed; according to extremum theory, the distribution of values ​​exceeding the limit is well approximated by the generalized Pareto distribution, whose cumulative distribution function is:

[0045] ;

[0046] in ξ is the scale parameter, and ξ is the shape parameter. These two parameters are fitted using the filtered out-of-value data through methods such as maximum likelihood estimation.

[0047] After determining the parameters of the generalized Pareto distribution, a very small acceptable risk probability is set. Then, the threshold corresponding to this probability is calculated in reverse based on the model. That is, the error value exceeds The probability is only The calculation formula is as follows:

[0048] ;

[0049] in It is the total number of observations. It exceeds the initial threshold. The number of observations.

[0050] Furthermore, the lightweight LAKE protocol is as follows:

[0051] The client sends its unique device ID and a random number to the server; the server responds with its certificate, a server random number, and the public key of a pre-generated elliptic curve cryptography (ECC) key pair.

[0052] The client verifies the validity of the server certificate. Once the verification is successful, the client generates a temporary symmetric session key, encrypts it using the server's ECC public key, and then sends the encrypted session key to the server.

[0053] The server uses its ECC private key to decrypt and obtain the session key.

[0054] A traffic monitoring system based on an independently controllable embedded operating system for power business includes an embedded data collector, a secure transmission module, and a cloud-based detection engine, as follows: The embedded data collector is a lightweight agent deployed on the independently controllable operating system of the power equipment. It is responsible for capturing communication traffic data flowing through the equipment in real time and aggregating the communication traffic data within a preset time window to extract traffic statistical features. The secure transmission module encapsulates and encrypts the extracted feature data using the LAKE protocol before securely transmitting it to the cloud-based detection engine. The cloud-based detection engine receives and decrypts data from various embedded devices. It first uses this data to dynamically construct a network communication graph, and then inputs the graph sequence into the ST-GAT model for anomaly scoring. When the anomaly score of a node or edge exceeds a dynamically set threshold, the system generates an alarm to notify maintenance personnel for handling.

[0055] The present invention has the following beneficial effects:

[0056] 1. This invention not only achieves real-time and efficient collection and end-to-end encryption of network traffic at power terminals, but also intelligently identifies various potential risks and attack behaviors through global modeling of network communication behavior;

[0057] 2. This invention combines the Spatiotemporal Graph Attention Network (ST-GAT) with power business traffic monitoring, breaking through the limitations of traditional rule-based and single machine learning algorithms. By dynamically constructing network communication graphs and combining them with time series analysis, the system can capture complex spatiotemporal relationships in the power network, significantly improving the accuracy and real-time performance of anomaly detection, and can identify covert lateral movement attacks and complex multi-stage attack behaviors.

[0058] 3. This invention uses the LAKE protocol to significantly reduce the number of round trips and computational complexity by removing complex cipher suite negotiations and extensions that are not suitable for this scenario, thereby greatly shortening the session establishment time. Optimization for this specific scenario makes it more suitable for resource-constrained embedded environments than the general-purpose TLS protocol. Attached Figure Description

[0059] Figure 1 This is a system architecture diagram of the present invention. Detailed Implementation

[0060] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0061] refer to Figure 1 In this embodiment, a traffic monitoring method for an independently controllable embedded operating system for power services is provided, including the following steps:

[0062] S1: Real-time capture of communication traffic data of industrial protocols through embedded acquisition devices deployed in substation IED equipment, regional terminal units (RTUs) and main control centers;

[0063] S2: Based on communication traffic data, the cloud uses the ST-GAT model to analyze the spatiotemporal interaction patterns between devices, and detects distributed denial-of-service attacks, port scans, illegal command injections, and data leakage attacks against the power control system in real time.

[0064] S3: On intelligent electronic devices running an autonomous and controllable operating system, a lightweight LAKE protocol is integrated to achieve encrypted data transmission, establishing a secure end-to-cloud communication link in resource-constrained environments.

[0065] In this embodiment, communication traffic data is converted into a dynamic graph representation. Within a time period... The communication traffic within is defined as a dynamic graph snapshot sequence. The topology of the graph changes at different time steps; at each time step Build a graph ,in: It is a set of nodes, representing all active communication devices in the power grid, each uniquely identified by its IP address; For the edge in the time window Inside, if the equipment With equipment If communication occurs between them, then there exists an edge in the graph. ; For node characteristics, each node eigenvectors It is derived from the metadata statistics that are observable within that time window, such as the total number of bytes sent or received, the number of connections initiated or received, etc. Similarly, for edge features, each edge... eigenvectors This describes the cryptographic robustness properties of the communication link. These characteristics include flow statistics such as protocol type, total number of packets, average packet size, variance of packet size, mean and variance of packet arrival intervals. These fine-grained metadata features are crucial for distinguishing between normal operation and abnormal traffic patterns without decrypting the content.

[0066] In this embodiment, the ST-GAT model consists of a spatial feature extraction module (GAT), a temporal feature extraction module (GRU), and a reconstruction decoder. The reconstruction decoder employs a reconstruction-based unsupervised approach to train the model and detect anomalies. The ST-GAT encoder performs time-step... Generate the final representation for each node Then, a simple fully connected layer decoder uses this representation to predict the node's position at the next time step. original features .

[0067] In this embodiment, the spatial feature extraction module is specifically as follows:

[0068] For each time step The picture It employs an edge-aware graph attention network to learn the context-aware representation of each node; through a self-attention mechanism, it can dynamically assign different importance weights to the neighbors of each node; for nodes... In its first The update process of layer GAT is as follows: First, compute nodes... with his neighbors Attention coefficient between This coefficient takes into account the characteristics of the source node, the target node, and the edges connecting them:

[0069]

[0070] in and These are the source nodes. and its neighboring nodes In the feature representation of the previous layer It is a feature representation of the edges connecting them; and It is a learnable linear transformation matrix used to project the features of nodes and edges onto a unified feature space; the symbol || represents the concatenation operation, merging the three transformed feature vectors into a single long vector; and This is the transpose of a learnable weight vector;

[0071] By By performing a dot product operation with this concatenated long vector, the model can map the high-dimensional information describing the relationships between nodes into a single scalar value, namely the unnormalized attention score, which measures the neighbors. For nodes The importance of;

[0072] Then, the attention coefficients of all neighbors are normalized using the softmax function to obtain the attention weights. :

[0073] ;

[0074] Finally, the node is updated by weighted summation of the features of its neighbors. The representation of:

[0075]

[0076] in It is a non-linear activation function;

[0077] A multi-head attention mechanism is employed. The core idea of ​​this mechanism is to move away from relying on a single attention function and instead execute them in parallel. Each attention calculation process is a separate process, called a head. Each head has its own independent learnable weight parameters, allowing different heads to learn to focus on different aspects or subsets of features related to the relationships between nodes—for example, one head might focus on traffic volume, while another might focus on protocol type. In all... After calculating the weighted features of each node, their results are concatenated to form the final node output feature of that layer. The final node representation update formula is as follows:

[0078]

[0079] in It is the first Normalized attention weights calculated from each attention head. It is the corresponding linear transformation matrix, and || represents the concatenation operation.

[0080] In this embodiment, the time feature extraction module is specifically as follows:

[0081] Based on the output of the spatial feature extraction module, at each time step All for each node We obtain an embedding vector rich in contextual information. The embedding sequence of each node is input into a gated recurrent unit network.

[0082] The time feature extraction module at the time step The state update process is as follows, all of which are in the formula. , Matrix and The vectors are all learnable parameters independent of the temporal feature extraction module and are not shared with the parameters in the temporal feature extraction module.

[0083] (1) Reset the door :

[0084] ;

[0085] Input at the current moment Compared to the previous hidden state Combined and activated by a sigmoid function; when When an element is close to 0, it means that the model will ignore the information of the corresponding dimension when calculating the next candidate state; conversely, when it is close to 1, it means that it will be completely retained.

[0086] (2) Update the door :

[0087] ;

[0088] The function of the update gate is to control the state information of the previous moment. How many are directly incorporated into the final state at the current moment? middle;

[0089] (3) Candidate hidden state :

[0090] ;

[0091] Used reset door The output is used to control the inflow of historical information. This represents element-wise product, combined with the current input. To generate new candidate memories; The tanh activation function;

[0092] (4) Final hidden state :

[0093] ;

[0094] Finally, the model updates the gates. To linearly interpolate and combine the old hidden states and new candidate hidden states The first part of the formula (1- ) The second part determines how many old memories to retain. It determines the amount of new information absorbed.

[0095] The final hidden state It is a node At time step The final spatiotemporal representation integrates spatial neighborhood information in the network topology at the current moment, as well as the temporal evolution history of the node's own state.

[0096] In this embodiment, the training objective of the ST-GAT model is to minimize the reconstruction error on normal data.

[0097] For each node At time step abnormal scores It can be defined as the L2 norm of its feature reconstruction error:

[0098] :

[0099] A dynamic threshold selection strategy based on extremum theory, namely the peak thresholding algorithm, is adopted:

[0100] (1) Screening extreme values: from the normal reconstruction error over a period of time Choose a higher initial quantile as the threshold. Only focus on values ​​exceeding this initial threshold. The error value, i.e., the peak value;

[0101] (2) Fitting extreme value distribution: For these peak values ​​that exceed the initial threshold Modeling is performed; according to extremum theory, the distribution of values ​​exceeding the limit is well approximated by the generalized Pareto distribution, whose cumulative distribution function is:

[0102] ;

[0103] in ξ is the scale parameter, and ξ is the shape parameter. These two parameters are fitted using the filtered out-of-value data through methods such as maximum likelihood estimation.

[0104] After determining the parameters of the generalized Pareto distribution, a very small acceptable risk probability is set. Then, the threshold corresponding to this probability is calculated in reverse based on the model. That is, the error value exceeds The probability is only The calculation formula is as follows:

[0105] ;

[0106] in It is the total number of observations. It exceeds the initial threshold. The number of observations.

[0107] In this embodiment, the lightweight LAKE protocol is specifically as follows:

[0108] The client (embedded device) sends its unique device ID and a random number to the server; the server responds with its certificate, a server random number, and the public key of a pre-generated elliptic curve cryptography (ECC) key pair.

[0109] The client verifies the validity of the server certificate. Once the verification is successful, the client generates a temporary symmetric session key, encrypts it using the server's ECC public key, and then sends the encrypted session key to the server.

[0110] The server uses its ECC private key to decrypt and obtain the session key. At this point, both parties possess the shared symmetric key. All subsequent business data will be transmitted encrypted using this session key and an efficient authentication encryption mode, ensuring the confidentiality and integrity of communication.

[0111] A traffic monitoring system based on an independently controllable embedded operating system for power business includes an embedded data collector, a secure transmission module, and a cloud-based detection engine, as follows: The embedded data collector is a lightweight agent deployed on the independently controllable operating system of the power equipment. It is responsible for capturing communication traffic data flowing through the equipment in real time and aggregating the communication traffic data within a preset time window to extract traffic statistical features. The secure transmission module encapsulates and encrypts the extracted feature data using the LAKE protocol before securely transmitting it to the cloud-based detection engine. The cloud-based detection engine receives and decrypts data from various embedded devices. It first uses this data to dynamically construct a network communication graph, and then inputs the graph sequence into the ST-GAT model for anomaly scoring. When the anomaly score of a node or edge exceeds a dynamically set threshold, the system generates an alarm to notify maintenance personnel for handling.

[0112] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0114] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0115] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0116] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for autonomous controllable embedded operating system traffic monitoring for power business, characterized in that, The method comprises the following steps: S1: Real-time capture of communication traffic data of industrial protocols through embedded collectors deployed in substation IED devices, regional terminal units and master control centers; S2: According to the communication traffic data, the cloud side detects distributed denial of service attacks, port scanning, illegal instruction injection and data leakage attacks against the power control system in real time based on the ST-GAT model by analyzing the space-time interaction mode between devices; S3: On the intelligent electronic device running the autonomous controllable operating system, integrate the lightweight LAKE protocol to realize encrypted data transmission, and establish a secure communication link from the end to the cloud in a resource-limited environment.

2. The power traffic oriented autonomous controllable embedded operating system monitoring method according to claim 1, characterized in that, Transforming communication traffic data into a representation of dynamic graphs, where the communication traffic within a time period is defined as a sequence of dynamic graph snapshots , where the topology of the graph changes at different time steps; at each time step , a graph is constructed, where: is the set of nodes, representing all active communication devices in the power network, each uniquely identified by its IP address; is the set of edges within the time window , an edge exists in the graph if a communication between device occurred within the time window ; is the set of node features, the feature vector of each node is derived from the observable metadata of the device within the time window; is the set of edge features.

3. The power traffic oriented autonomous controllable embedded operating system monitoring method of claim 2, wherein, The ST-GAT model is composed of a spatial feature extraction module GAT, a temporal feature extraction module GRU and a reconstruction decoder.

4. The power traffic oriented autonomous controllable embedded operating system monitoring method according to claim 3, characterized in that, The spatial feature extraction module is specifically as follows: For each time step The picture It employs an edge-aware graph attention network to learn the context-aware representation of each node; through a self-attention mechanism, it can dynamically assign different importance weights to the neighbors of each node; for nodes... In its first The update process of layer GAT is as follows: First, compute nodes... with his neighbors Attention coefficient between This coefficient takes into account the characteristics of the source node, the target node, and the edges connecting them: ； wherein and are source nodes and their neighbor nodes are feature representations of the nodes at the previous layer, is a feature representation of the edges connecting them; and are learnable linear transformation matrices for projecting the features of nodes and edges into a unified feature space; The symbol || represents a splicing operation, which combines the three transformed feature vectors into a long vector; and is the transpose of a learnable weight vector; Then, the attention coefficients of all neighbors are normalized using a softmax function to obtain the attention weights : ； Finally, the features of the neighbor nodes are updated by weighted sum representation: ； wherein is a non-linear activation function; A multi-head attention mechanism was adopted, in all After calculating the weighted features of each node, their results are concatenated to form the final node output feature of that layer. The final node representation update formula is as follows: ； wherein is a normalized attention weight computed by the jth attention head, is its corresponding linear transformation matrix, and || denotes a concatenation operation.

5. The power traffic oriented autonomous controllable embedded operating system monitoring method according to claim 4, characterized in that, The temporal feature extraction module is specifically as follows: According to the output of the spatial feature extraction module, at each time step a contextually rich embedding vector is obtained for each node the embedding sequence of each node is input into a network of gated recurrent units,​ The time feature extraction module is at a time step The state update process is as follows, all , Matrices and Vectors in the formula are independent learnable parameters of the time feature extraction module, and are not shared with parameters in the time feature extraction module. (1) Resetting the door : ; Input at the current moment Compared to the previous hidden state Combined and activated by a sigmoid function; when When an element is close to 0, it means that the model will ignore the information of the corresponding dimension when calculating the next candidate state; conversely, when it is close to 1, it means that it will be completely retained. (2) updating the door : ; The update gate controls the state information from the previous time step How much of the final state is carried directly into the current time step The output gate controls the output of the current time step (3) Candidate hidden states : ; The output of the reset gate is used to control the inflow of historical information. represents an element-wise product, combined with the current input to generate new candidate memories; is a tanh activation function;​ (4) Final hidden state : ; Finally, the model combines the old hidden state and the new candidate hidden state linearly through the update gate ; the first part of the equation (1- ) determines how much old memory to retain, and the second part determines how much new information to absorb.

6. The power traffic oriented autonomous controllable embedded operating system monitoring method of claim 5, wherein, The training target of the ST-GAT model is to minimize the reconstruction error on normal data, For each node At time step Anomaly score Can be defined as the L2 norm of its feature reconstruction error: ： A dynamic threshold selection strategy based on extreme value theory, namely peak threshold algorithm, is adopted: (1) Screening extreme values: from the normal reconstruction error over a period of time Choose a higher initial quantile as the threshold. Only focus on values ​​exceeding this initial threshold. The error value, i.e., the peak value; (2) Fit the extreme value distribution: to the part of these peaks that exceed the initial threshold modeling; according to the extreme value theory, the distribution of exceedances is well approximated by a generalized Pareto distribution with cumulative distribution function ； wherein is a scale parameter, and ξ is a shape parameter, which are fitted by using the selected outliers by maximum likelihood estimation or the like; After the parameters of the generalized Pareto distribution are determined, a small acceptable risk probability is set Then, the threshold value corresponding to this probability is calculated backwards from the model That is, the probability of an error value exceeding is only The formula for calculating it is: ； wherein is the total number of observations, is the number of observations that exceed the initial threshold value.

7. The power traffic oriented autonomous controllable embedded operating system monitoring method of claim 1, wherein, The lightweight LAKE protocol is specifically as follows: The client sends its unique device ID and a random number to the server; the server responds with its certificate, a server random number, and the public key of a pre-generated elliptic curve cryptography (ECC) key pair; The client verifies the validity of the server certificate, and after verification, the client generates a temporary symmetric session key and encrypts it using the server's ECC public key, then sends the encrypted session key to the server; The server uses its ECC private key to decrypt the session key.

8. An autonomously controllable embedded operating system traffic monitoring system for power business operations, characterized by The embedded collector, secure transmission module and cloud detection engine are specifically as follows: The embedded collector is a lightweight agent deployed on the autonomous controllable operating system of the power device, responsible for real-time capture of communication traffic data flowing through the device, and aggregation of the communication traffic data within a preset time window to extract traffic statistical features; The secure transmission module: The embedded collector encapsulates and encrypts the extracted feature data through the LAKE protocol, and then securely transmits it to the cloud detection engine; The cloud detection engine: The cloud server receives and decrypts the data from each embedded device, first dynamically constructs a network communication graph using these data, then inputs the graph sequence into the ST-GAT model for anomaly scoring, when the anomaly score of a certain node or edge exceeds the dynamically set threshold, the system will generate an alarm to notify the operation and maintenance personnel for processing.

Images