Threat detection and self-evolution defense system for AI electric power industrial control network

Abstract

The invention relates to the technical field of power system network security, and discloses an AI power industrial control network threat detection and self-evolution defense system, which comprises a data acquisition and preprocessing module used for acquiring and preprocessing multi-source heterogeneous data of a power industrial control network; the time sequence anomaly detection module is used for carrying out time sequence anomaly detection on the standardized fusion feature vector sequence; the topology anomaly detection module is used for carrying out topology anomaly detection on the standardized fusion feature vector sequence; the comprehensive anomaly judgment module is used for calculating an anomaly detection threshold value, calculating a comprehensive anomaly score and comparing the anomaly detection threshold value with the comprehensive anomaly score; the threat intelligence analysis module is used for constructing an electric power industrial control threat knowledge graph and performing threat intelligence analysis based on a comprehensive anomaly detection result; the defense strategy optimization module is used for performing defense strategy optimization; the self-evolution learning module is used for driving continuous evolution of threat detection and defense strategies; the safety protection capability of the electric power industrial control network is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system network security, more particularly, it relates to an AI power industrial control network threat detection and self-evolution defense system. BACKGROUND

[0002] With the deepening of the digital transformation of the power system, the deep integration of power industrial control systems and information technology networks has become an inevitable trend. Especially in the field of new energy, the large-scale access of distributed power sources such as wind farms and photovoltaic power stations has dramatically increased the size and complexity of power industrial control networks. These new energy stations are interconnected with regional dispatching centers through industrial control networks to realize remote control functions such as power prediction, active and reactive power regulation, and fault removal, which have an important influence on the safe and stable operation of the power grid. However, the openness of the power industrial control network has also brought serious network security challenges. In recent years, there have been frequent advanced persistent threat attacks on the power system, and the attack methods have become increasingly complex and concealed.

[0003] Currently, the security protection of the power industrial control network mainly relies on traditional boundary protection devices and rule-based intrusion detection systems. These systems use static detection rules and defense strategies, which can effectively identify known attack characteristics, but lack the ability to detect new unknown threats. At the same time, the existing solutions lack the ability to perceive the operating conditions of the power system. Under extreme weather, equipment maintenance, and other special operating conditions, the normal business traffic pattern changes dramatically, and the traditional fixed threshold detection method is prone to produce a large number of false positives, seriously affecting the operation and maintenance efficiency, and may also miss concealed attacks that take advantage of operating condition changes as cover.

[0004] In addition, the existing security defense system uses pre-defined static rules, and the defense strategy is difficult to adjust dynamically according to the threat situation changes once configured. Attackers can understand the defense rules through exploratory attacks and then design bypass strategies. Although machine learning-based threat detection and defense methods have certain adaptive ability, they face the problem of lack of attack samples in the industrial control field, and the model training effect is limited, making it difficult to cope with evolving new threats. Therefore, it is necessary to research an AI power industrial control network security system with environmental perception ability, intelligent threat detection ability, and self-evolution defense ability. SUMMARY

[0005] The present application provides an AI power industrial control network threat detection and self-evolution defense system, which solves the technical problems of insufficient detection ability for new unknown threats and lack of perception ability for the operating conditions of the power system in related technologies.

[0006] The present application provides an AI power industrial control network threat detection and self-evolution defense system, which includes: a data acquisition and preprocessing module, configured to acquire and preprocess multi-source heterogeneous data of the industrial control network to obtain a standardized fusion feature vector sequence; a time sequence anomaly detection module, configured to construct a time sequence anomaly detection model, perform time sequence anomaly detection on the standardized fusion feature vector sequence, and obtain a time sequence anomaly score sequence; a topology anomaly detection module, configured to construct a network topology graph model, perform topology anomaly detection on the standardized fusion feature vector sequence, and obtain a topology anomaly score; a comprehensive anomaly judgment module, configured to calculate an anomaly detection threshold, calculate a comprehensive anomaly score based on the time sequence anomaly score sequence and the topology anomaly score, and obtain a comprehensive anomaly detection result; a threat intelligence analysis module, configured to construct a power industrial control threat knowledge graph, perform threat intelligence analysis based on the comprehensive anomaly detection result, and obtain a threat intelligence correlation analysis result; a defense strategy optimization module, configured to perform defense strategy optimization based on the comprehensive anomaly detection result and the threat intelligence correlation analysis result, and obtain an optimal defense action sequence; an auto-evolution learning module, configured to drive continuous evolution of threat detection and defense strategies based on the optimal defense action sequence, and obtain an adaptive security protection strategy.

[0007] In a preferred embodiment, the data acquisition and preprocessing module comprises: a primary time server is deployed in the regional dispatching center, a time reference is obtained through a satellite time system, a secondary time server is deployed in each new energy station, time synchronization is performed with the primary time server, and each data acquisition node is taken as a tertiary time client to perform synchronization with the secondary time server of the station; a flow acquisition probe is deployed, network flow data is obtained in a port mirroring manner, and the acquired raw flow data includes Ethernet frame header information, network layer protocol header information, transmission layer protocol header information, and application layer load data; deep protocol analysis is performed on the acquired industrial control protocol message, feature information at a protocol semantic level is extracted, and the protocol analysis result is stored in a structured format.

[0008] In a preferred embodiment, the data acquisition and preprocessing module further comprises: time alignment processing is performed on the multi-source heterogeneous data, a uniform time window length is set, and all data is distributed to corresponding time windows according to time stamps; for data with a collection frequency higher than a window frequency, down-sampling is performed in a window aggregation manner; for data with a collection frequency lower than the window frequency, up-sampling is performed by using a linear interpolation method; and for missing data, forward filling is performed; Feature engineering and standardization are performed on the time-aligned multi-source data. Numerical features are standardized using the Z-score method, and categorical features are converted into numerical vectors using one-hot encoding. All features are then concatenated to form a unified feature vector.

[0009] In a preferred embodiment, the timing anomaly detection module includes: We construct an input embedding layer for a lightweight Transformer encoder, which converts the normalized fused feature vector sequence into an embedding representation that the model can process. The input embedding layer contains a feature projection sublayer and a position encoding sublayer. The feature projection sublayer uses a linear transformation to project the original feature vectors onto the model's hidden dimension space, and the position encoding sublayer uses a learnable relative position encoding method to generate a position embedding vector for each position in the sequence. A self-attention layer based on a linear attention mechanism is constructed. The query vector and key vector are mapped to a non-negative space through a feature mapping function. The computation order is adjusted to reduce the complexity from being proportional to the square of the sequence length to being linearly related to the sequence length. A Transformer decoder is constructed to reconstruct the original input sequence, and the mean square error between the original feature vector and the reconstructed feature vector is calculated as the temporal anomaly score.

[0010] In a preferred embodiment, the topology anomaly detection module includes: Construct a network topology graph, which is defined as a combination of a set of nodes and a set of edges. Each node in the set of nodes represents a device or system in the network, and each edge in the set of edges represents a communication connection between two devices. Initialize a feature vector for each node in the network topology graph. The node feature vector consists of static attribute features and dynamic behavior features. A graph neural network architecture based on neighbor sampling is used for node embedding learning. For each target node, a preset number of nodes are randomly sampled from its first-order neighbors. For the sampled first-order neighbors, a preset number of second-order neighbors are then sampled from its neighbors. Construct a neighbor aggregation layer in a graph neural network to update the representation of the target node by aggregating the feature information of neighbor nodes; An anomaly detection module is added after the output layer of the graph neural network, and the isolated forest algorithm is used to score anomalies in the node embedding vectors.

[0011] In a preferred embodiment, the comprehensive anomaly determination module includes: A classification model for operating conditions is constructed. Based on meteorological environmental data and equipment operating status data, the current operating conditions are classified into predefined operating condition categories, including normal operating conditions, extreme weather operating conditions, equipment maintenance operating conditions, peak load operating conditions, and system disturbance operating conditions. Differentiated normal behavior baseline models are established for each type of operating condition, forming a baseline model library. Normal operating period data belonging to specific operating condition categories are selected from historical data, and statistical characteristics of time-series anomaly scores and topological anomaly scores are calculated. Based on the current working condition classification results, the corresponding baseline model is selected from the baseline model library, and the anomaly detection threshold is dynamically calculated. The coefficients take different values ​​according to the working condition type. The time-series anomaly score and the topological anomaly score are weighted and fused to calculate the comprehensive anomaly score.

[0012] In a preferred embodiment, the threat intelligence analysis module includes: Construct a threat knowledge graph in the field of power industrial control, define the ontology model and entity relationships of the knowledge graph. Entity types include attack tactic entities, attack technology entities, attack tool entities, vulnerability entities, threat actor entities, attack target entities, and defense measure entities. Relationship types include tactics including technology, technology using tools, technology exploiting vulnerabilities, actor adopting technology, technology targeting targets, and measures mitigation technology. The abnormal alarms are mapped to attack technology entities in the knowledge graph. The alarm features and technical features are encoded into vector representations respectively. The cosine similarity between the alarm feature vector and each technical feature vector is calculated. Technical entities with similarity exceeding a preset threshold are selected as matching results. Graph embedding technology is used to map entities and relationships in the knowledge graph to a low-dimensional vector space. Knowledge reasoning is performed based on the graph embedding vectors to infer the attack chain and subsequent attack actions related to the current alarm.

[0013] In a preferred embodiment, the defense strategy optimization module includes: The defense strategy optimization problem is modeled as a constrained Markov decision process, defining the state space, action space, state transition function, reward function, and constraint function. Define the defense action space, including access control adjustment actions, network isolation actions, traffic rate limiting actions, honeypot inducement actions, proactive source tracing actions, and alarm escalation actions; Design a reward function that is a weighted combination of security benefits minus business impact minus resource consumption. Design safety constraints, which are defined as the business impact assessment function value not exceeding a preset maximum impact threshold. A deep neural network is constructed as the policy network, and a constrained policy optimization algorithm is used to train the policy network to maximize the cumulative reward while satisfying safety constraints.

[0014] In a preferred embodiment, the self-evolutionary learning module includes: Construct an attack sample database, where each attack sample contains raw traffic data, protocol parsing results, attack type tags, attack stage tags, and target device type; A conditional Wasserstein generative adversarial network is constructed, consisting of a generator network and a discriminator network. The input of the generator network is a concatenation of a random noise vector and an attack type condition vector, and the output is a generated simulated attack traffic feature vector. Wasserstein distance is used as the training objective of the generative adversarial network, and a gradient penalty term is introduced to ensure training stability. A conditional information control mechanism is introduced into the generator to achieve targeted generation of samples for specific attack types. The conditional control is implemented through a conditional batch normalization layer. The design generates a sample quality assessment mechanism to screen high-quality generated samples. The quality assessment is carried out from three dimensions: distribution similarity assessment, detection effectiveness assessment, and diversity assessment. The selected high-quality generated samples were added to the training dataset to retrain the temporal anomaly detection module, the topology anomaly detection module, and the defense strategy optimization module. Establish a policy performance monitoring mechanism and an automatic retraining trigger mechanism to automatically trigger the policy update process when a policy performance degradation is detected.

[0015] A computer-readable storage medium for storing computer-readable instructions that, when read by a computer, enable the execution of the aforementioned AI-based power industrial control network threat detection and self-evolving defense system.

[0016] The beneficial effects of this invention are as follows: By integrating a multimodal detection method that combines lightweight Transformer temporal anomaly detection and sampling graph neural network topology anomaly detection, and combining it with an adaptive threshold adjustment mechanism based on meteorological environment and equipment operating status, this method can accurately identify known and unknown threats under complex and ever-changing operating conditions. It effectively reduces the false alarm rate under special conditions such as extreme weather, while improving the detection capability against covert attacks. This solves the technical problems of poor detection performance caused by the single detection method and lack of environmental awareness in existing technologies.

[0017] By adopting an adaptive defense strategy optimization method based on security constraint reinforcement learning and combining it with attack scenario generation technology of conditional generative adversarial networks, dynamic optimization of defense strategies and continuous evolution of the system are achieved. The system can automatically adjust defense strategies according to changes in the threat situation and solve the problem of scarce attack samples in the industrial control field by generating diverse attack scenarios. This enables the system to have the ability to learn autonomously to cope with new types of attacks and solves the technical problems of static and rigid defense strategies and difficulty in model evolution in existing technologies. Attached Figure Description

[0018] Fig. 1 This is a block diagram of an AI-based power industrial control network threat detection and self-evolving defense system according to the present invention. Fig. 2 This is a detailed flowchart of an AI-based power industrial control network threat detection and self-evolving defense system according to the present invention. Detailed Implementation

[0019] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0020] At least one embodiment of the present invention discloses an AI-based power industrial control network threat detection and self-evolving defense system, such as... Figs. 1-2 As shown, it includes: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous data from the power industrial control network and preprocess it to obtain a standardized fusion feature vector sequence. Specifically, it includes the following: Step 1.1: Deploy a three-tier network time synchronization service architecture; A unified time synchronization service is deployed based on the network time protocol to calibrate the clocks of data acquisition nodes distributed across various new energy power plants. A primary time server is deployed at the regional dispatch center, which obtains a high-precision time reference through a satellite time synchronization system, achieving microsecond-level accuracy. Each new energy power plant deploys a secondary time server, which synchronizes with the primary time server via a dedicated fiber optic network. The synchronization period is set as a configurable parameter, with a preferred value of sixty seconds. Each data acquisition node acts as a tertiary time client, synchronizing with its own secondary time server to ensure that the time deviation across the entire network is controlled within milliseconds. The time synchronization service employs a redundant design, automatically switching to a backup server when the primary time server fails, ensuring the continuity of the time synchronization service.

[0021] Step 1.2: Deploy traffic acquisition probes at key network nodes; Traffic acquisition probes are deployed at key nodes of the power control network to acquire network traffic data using port mirroring. These probes are deployed at communication gateways between the substation and the dispatch center, aggregation switches within various functional areas of the substation, and access switches connecting critical control equipment. Each probe is configured with an independent data buffer queue, with the buffer capacity set based on network bandwidth and processing capabilities, ideally at one gigabyte. The acquired raw traffic data includes Ethernet frame header information, network layer protocol header information, transport layer protocol header information, and application layer payload data, with each record appended with a timestamp accurate to microseconds.

[0022] Step 1.3: Perform deep parsing on the industrial control protocol messages to extract semantic features; Deep protocol parsing is performed on the collected industrial control protocol messages to extract semantic-level feature information. For the Modbus TCP protocol, fields such as transaction identifier, protocol identifier, length field, unit identifier, function code, data address, and data value are parsed, with particular attention paid to messages with function codes indicating write operations such as writing a single register, writing multiple registers, or forcing a single coil. For the IEC 61850 MMS protocol, the service type field is parsed to distinguish operation types such as read requests, write requests, and report requests, and semantic information such as logical node references, data object references, and functional constraints is extracted. For the IEC 60870-5-104 protocol, fields such as type identifier, variable structure qualifiers, transmission reason, common address, and information object address in the application protocol data unit are parsed to identify different types of data frames such as telemetry, telesignaling, remote control, and remote adjustment. The protocol parsing results are stored in a structured format, including standardized fields such as protocol type, operation type, target object, operation parameters, and timestamp.

[0023] Step 1.4: Collect equipment operating status and alarm information; Equipment operating status data is acquired from the data interface of the power monitoring system. The collected data includes electrical quantities such as generator active power output, reactive power output, generator terminal voltage, and speed; system operating parameters such as bus voltage, bus frequency, line active power flow, and line reactive power flow; and switch quantity information such as circuit breaker status, disconnector status, and protection device action signals. Simultaneously, equipment alarm information and protection action records are collected, including alarm type, alarm level, alarm time, and associated equipment attributes. The data acquisition cycle for equipment operating status data is set according to different data types; the preferred acquisition cycle for electrical quantities is one second, while switch quantities are transmitted in real time using a position-triggered method.

[0024] Step 1.5: Collect meteorological and environmental data and early warning information; Environmental monitoring data is acquired from the meteorological information system, including parameters such as wind speed, wind direction, solar irradiance, ambient temperature, relative humidity, and air pressure. For wind farms, the focus is on collecting wind speed and direction data at the hub height; for photovoltaic power stations, the focus is on collecting irradiance data on the tilted surface. The optimal meteorological data acquisition cycle is ten seconds. Simultaneously, meteorological early warning information is acquired, including typhoon warnings, cold wave warnings, lightning warnings, and sandstorm warnings. Warning information includes attributes such as warning type, warning level, warning time, and affected area.

[0025] Step 1.6: Perform time alignment of multi-source data based on the time window alignment algorithm; Time alignment is performed on multi-source heterogeneous data based on a time window alignment algorithm. The specific process of time alignment is as follows: a uniform time window length is set, which is set according to the real-time requirements of detection and data characteristics, with a preferred value of 1 second. The start time of the time window is aligned to the whole second boundary. All data are assigned to the corresponding time window according to their timestamps. Data whose timestamps fall between the start and end times of the window belong to that window.

[0026] For data with a sampling frequency higher than the window frequency, downsampling is performed using in-window aggregation. The aggregation method is selected based on the data characteristics: mean aggregation or maximum aggregation is used for numerical data, and count aggregation is used for event-type data. For data with a sampling frequency lower than the window frequency, upsampling is performed using linear interpolation. The current window value is calculated by adding the previous sample value to the product of the time ratio and the difference between adjacent sample values. For missing data, forward imputation is used, i.e., the most recent valid value is used to fill the missing data. If consecutive missing values ​​exceed a preset threshold, the window is marked as invalid.

[0027] Step 1.7: Perform feature engineering and standardization on the multi-source data; Feature engineering and standardization are performed on the time-aligned multi-source data. Numerical features are standardized using the Z-score method, where the original value is subtracted from the mean and then divided by the standard deviation to obtain the standardized value. The mean and standard deviation are calculated based on a sliding window of historical data, with a preferred sliding window length of 24 hours. Categorical features are converted into numerical vectors using one-hot encoding, with the encoding dimension equal to the number of categories. For industrial control protocol features, categorical features such as protocol type, function code, and operation type are encoded, while numerical features such as data address and data value are standardized. All features are concatenated to form a unified feature vector, with the feature vector dimension determined based on the data type and number of features collected. The standardized feature vectors are then organized into a sequence in chronological order, outputting a standardized fused feature vector sequence.

[0028] The temporal anomaly detection module is used to build a temporal anomaly detection model, perform temporal anomaly detection on the standardized fused feature vector sequence, and obtain a temporal anomaly score sequence; Specifically, it includes the following: Step 2.1: Construct the input embedding layer for feature projection and position encoding; We construct an input embedding layer for a lightweight Transformer encoder, which transforms the normalized fused feature vector sequence into an embedding representation that the model can process. The input embedding layer consists of two components: a feature projection sublayer and a position encoding sublayer. The feature projection sublayer uses a linear transformation to project the original feature vectors onto the model's hidden dimension space. The linear transformation calculation process is as follows: a weight matrix is ​​created, with the number of rows equal to the original feature dimension and the number of columns equal to the hidden dimension. The hidden dimension is preferably set to 128 dimensions based on model capacity and computational resources. The input feature vector is multiplied by the weight matrix to obtain the projected vector, and a bias vector is added to obtain the final feature projection result. The positional encoding sublayer uses a learnable relative positional encoding method to generate a positional embedding vector for each position in the sequence. Specifically, a positional embedding lookup table is created, with the number of rows equal to the maximum sequence length (preferably 1024) and the number of columns equal to the hidden dimension. Each element in the table is updated as a learnable parameter during training. For the element with position index i in the sequence, the i-th row is extracted from the lookup table as the positional embedding vector for that position. The positional embedding vector is added element-wise to the feature projection vector to obtain the final input embedding. Compared with absolute positional encoding, relative positional encoding can better capture the relative temporal relationship between sequence elements and has a stronger expressive power for periodic patterns in industrial control communication sequences.

[0029] Step 2.2: Construct the self-attention layer of the linear attention mechanism; A self-attention layer based on a linear attention mechanism is constructed to replace the dot product attention mechanism in the standard Transformer to reduce computational complexity. The linear attention mechanism maps the query vector and key vector to a non-negative space through a feature mapping function, adjusting the computation order to reduce the complexity from being proportional to the square of the sequence length to being linearly related to the sequence length. Specifically, the computation process of linear attention is as follows: the feature mapping function is applied to both the query matrix and the key matrix, using an exponential linear unit activation function plus one to ensure the mapping result is non-negative; the product of the mapped key matrix and value matrix is ​​calculated to obtain the global context matrix; the product of the mapped query matrix and the global context matrix is ​​calculated and normalized to obtain the attention output. This computational method avoids explicitly calculating the attention weight matrix, reducing memory usage and computation time.

[0030] Step 2.3: Add a feedforward neural network layer to perform nonlinear transformation; A feedforward neural network layer is added after the self-attention layer to perform a non-linear transformation on the attention output, enhancing the model's expressive power. The feedforward neural network consists of two linear transformation layers and one activation function layer. The first linear transformation layer expands the hidden dimension to four times its original size, using a Gaussian error linear unit (GaU) as the activation function. The second linear transformation layer restores the dimension to the original hidden dimension. The computation process of the feedforward neural network is as follows: the input vector undergoes the first linear transformation to obtain the expanded vector; the expanded vector undergoes a non-linear transformation using the GaU activation function; and the activated vector undergoes the second linear transformation to obtain the output vector. Compared to the traditional modified linear unit (CLU) activation function, the GaU has smoother gradient characteristics, which is beneficial to the stability of model training.

[0031] Step 2.4: Construct an encoder block with residual connections and layer normalization; A complete Transformer encoder block is constructed using residual connections and layer normalization techniques. Each encoder block contains a self-attention sub-layer and a feedforward sub-layer, with each sub-layer configured with residual connections and layer normalization. Residual connections directly add the sub-layer's input to its output, mitigating the vanishing gradient problem in deep networks. Layer normalization normalizes the feature dimensions of each sample. The calculation process involves: calculating the mean and variance of the feature vector, subtracting the mean from the feature vector and dividing by the standard deviation, multiplying by a learnable scaling parameter, and adding a learnable offset parameter. The number of stacked layers in the encoder block is set according to the model capacity requirements, with a preferred value of 4 layers. The parameters of each layer are learned independently.

[0032] Step 2.5: Construct a decoder to reconstruct the original input sequence; A Transformer decoder is constructed to reconstruct the original input sequence. The decoder structure is symmetrical to the encoder. The decoder's input is the encoder's output representation, and the original feature vector is reconstructed step by step through multiple decoder blocks. In addition to self-attention sub-layers and feedforward network sub-layers, each decoder block contains an encoder-decoder cross-attention sub-layer to fuse the encoder's contextual information. The final layer of the decoder is a linear projection layer, which projects the hidden representation back to the original feature dimension, resulting in the reconstructed feature vector sequence.

[0033] Step 2.6: Calculate the time series anomaly score based on the reconstruction error; For each time window, the mean squared error between the original feature vector and the reconstructed feature vector is calculated as the anomaly score for that time window. The mean squared error is calculated by subtracting corresponding elements of the original vector from the reconstructed vector, squaring the difference, and averaging over all dimensions. A higher anomaly score indicates a greater deviation between the communication pattern of that time window and the normal pattern learned by the model, and a greater likelihood of anomalous behavior. To improve the stability of the anomaly score, a moving average is applied to the anomaly scores of multiple consecutive time windows, with the preferred moving average window length being five time windows.

[0034] Step 2.7: Continuously update model parameters using an online learning mechanism; An online learning mechanism is employed to continuously update model parameters to adapt to slow changes in data distribution. The loss function for model training is defined as the reconstruction error, which is the average of the mean squared error between the original feature vector and the reconstructed feature vector over the entire sequence. The smaller the loss function value, the stronger the model's reconstruction ability.

[0035] The online learning model employs a mini-batch stochastic gradient descent approach, updating parameters after each new batch of data is received. A cosine annealing scheduling strategy is used for the learning rate, with an initial optimal learning rate of 0.001 and a minimum optimal learning rate of 0.0001. To prevent the model from overfitting to recent data and forgetting historical patterns, an elastic weight consolidation method is used to constrain the magnitude of parameter updates, applying stronger regularization penalties to important parameters. Model parameters are periodically saved as checkpoints, allowing for rollback to historical checkpoints when an abnormal decline in model performance is detected.

[0036] The output is a temporal anomaly score sequence, containing anomaly scores for each time window arranged chronologically, with each time window corresponding to a single temporal anomaly score value. The anomaly score sequence is time-aligned with the original feature vector sequence to facilitate subsequent fusion analysis with other detection results.

[0037] The topology anomaly detection module is used to construct a network topology graph model, perform topology anomaly detection on the standardized fused feature vector sequence, and obtain a topology anomaly score. Specifically, it includes the following: Step 3.1: Construct the power industrial control network topology diagram; A network topology diagram is constructed based on the device connection and communication relationships of the power industrial control network. The network topology diagram is defined as a combination of a node set and an edge set. Each node in the node set represents a device or system in the network, including industrial control equipment such as remote terminal units, programmable logic controllers, human-machine interfaces, data acquisition servers, and communication gateways, as well as network devices such as switches, routers, and firewalls. Each edge in the edge set represents a communication connection between two devices, and the edge's attributes include connection type, communication protocol, and bandwidth capacity.

[0038] The network topology graph is constructed based on the equipment ledger information and network configuration information of the network asset management system, while dynamically identifying actual communication relationships by combining traffic analysis results. For dynamically changing communication relationships, the communication frequency within a sliding time window is used as the edge weight. Edges with a communication frequency below a preset threshold are considered temporary connections and are not included in the topology graph.

[0039] Step 3.2, initialize node feature vectors; Initialize a feature vector for each node in the network topology graph. The node feature vector consists of two parts: static attribute features and dynamic behavioral features. Static attribute features include inherent device attributes such as device type, device manufacturer, firmware version, network address, and region. These attributes are converted into numerical vectors through one-hot encoding or embedding encoding. Dynamic behavioral features are derived from the standardized feature vector. For each device node, traffic features, protocol features, and operational status features related to that device are extracted and aggregated into a behavioral feature vector for that node in the current time window. The static attribute features and dynamic behavioral features are concatenated to form a complete initial feature vector for the node. The feature dimension is determined based on the number of attributes and the behavioral feature dimension.

[0040] Step 3.3: Node embedding learning is performed using a neighbor sampling strategy; A neighbor-based graph neural network architecture is employed for node embedding learning to reduce computational complexity on large-scale graphs. The neighbor sampling strategy is as follows: for each target node, a fixed number of nodes are randomly sampled from its first-order neighbors, with a preferred number of 10 nodes; for each sampled first-order neighbor, a fixed number of second-order neighbors are then sampled from its neighbors, with a preferred number of 5 nodes. This hierarchical sampling method limits the computational neighborhood of each node to a controllable range, avoiding the high complexity of computation across the entire graph. An importance sampling strategy is used, weighting sampling based on edge weights, with frequently communicating neighbors having a higher sampling probability.

[0041] Step 3.4: Construct the neighbor aggregation layer to update the node representation; A neighbor aggregation layer is constructed in a graph neural network to update the representation of the target node by aggregating the feature information of neighboring nodes. The aggregation process uses a mean aggregator, which calculates as follows: collect the feature vectors of all sampled neighbors of the target node, calculate the element-wise mean of these feature vectors to obtain the neighbor aggregation vector; concatenate the target node's own feature vector with the neighbor aggregation vector, and then apply a linear transformation and a nonlinear activation function to obtain the updated node representation. The weight matrix of the linear transformation is a learnable parameter, and the activation function uses a modified linear unit. The updated node representation integrates the node's own information and neighbor context information, enabling it to capture the structural patterns in the network topology.

[0042] Step 3.5: Stack multiple layers of graph neural networks to expand the receptive field; Stacking multiple layers of graph neural networks expands the receptive field of nodes. Each layer aggregates information from more distant neighbors, resulting in a larger receptive field with more layers. Considering the oversmoothing problem of excessively deep graph neural networks (i.e., the representations of all nodes tend to be similar), the number of layers is set as a configurable parameter, with two layers being the preferred value. A two-layer graph neural network can aggregate information from second-order neighbors, which is sufficient to capture local structural patterns for typical power control network topologies. Residual connections are added between each layer to alleviate the vanishing gradient problem; these connections directly add the output of the previous layer to the output of the current layer.

[0043] Step 3.6: Use the Isolation Forest algorithm for anomaly scoring; An anomaly detection module is added after the output layer of the graph neural network to score anomalies in the node embedding vectors. Anomaly detection employs the Isolation Forest algorithm, which identifies anomalous samples by constructing a set of random decision trees. The basic principle of Isolation Forest is that anomalous samples, due to their different distribution from normal samples, are more easily isolated during random partitioning, meaning the average path length required to reach a leaf node is shorter. The construction process of Isolation Forest is as follows: a feature dimension is randomly selected, and a split point is randomly chosen within the range of values ​​for that dimension. The samples are divided into two subsets, and this process is repeated recursively until each sample is isolated or the maximum depth is reached. The anomaly score is calculated as the normalized value of the sample's average path length; the shorter the path, the higher the anomaly score. The optimal number of trees in the Isolation Forest is 100, and the optimal maximum depth is the logarithm of the node embedding dimension.

[0044] Step 3.7: Normalize and perform temporal smoothing on the outlier scores; The original anomaly scores output from the isolated forest are post-processed to generate the final topological anomaly scores. Post-processing includes score normalization and temporal smoothing. Score normalization uses a min-maximum normalization method, mapping the anomaly scores to a range of zero to one. The normalized score is calculated by subtracting the minimum value from the original score and dividing by the difference between the maximum and minimum values. Temporal smoothing applies an exponential moving average to the anomaly scores over consecutive time windows. The smoothed score is obtained by adding the product of the smoothing coefficient and the current score, plus the product of the smoothing coefficient and the smoothed score from the previous time step. The preferred smoothing coefficient is 0.3. Temporal smoothing reduces random fluctuations in single detections and improves the stability of anomaly detection.

[0045] Output a topology anomaly score, which includes anomaly ratings for all nodes in the network, with each node corresponding to a topology anomaly score value. The topology anomaly score complements the temporal anomaly score; the temporal anomaly score focuses on detecting anomalous patterns in a single communication sequence, while the topology anomaly score focuses on detecting anomalous behaviors at the network structure level, such as lateral movement attacks and the establishment of anomalous communication relationships.

[0046] The comprehensive anomaly determination module is used to calculate the anomaly detection threshold, calculate the comprehensive anomaly score based on the temporal anomaly score sequence and the topological anomaly score, and obtain the comprehensive anomaly detection result; Specifically, it includes the following: Step 4.1, construct the operating condition classification model; A classification model for operating conditions is constructed to categorize the current operating conditions into predefined categories based on meteorological and environmental data and equipment operating status data. These categories include five types: normal operation, extreme weather, equipment maintenance, peak load, and system disturbance. The classification model employs a gradient boosting decision tree algorithm. This algorithm iteratively trains multiple decision trees, with each tree fitting the residual from the previous iteration. The predictions from all trees are then summed to obtain the final prediction. Input features include: meteorological characteristics such as mean wind speed, standard deviation of wind speed, rate of change of wind direction, light intensity, temperature, and humidity; equipment status characteristics such as equipment online rate, number of alarms, and number of protection actions; and power grid operating characteristics such as system load level, frequency deviation, and voltage deviation. The model output is the probability distribution for each operating condition category, and the category with the highest probability is selected as the current operating condition classification result. The model training data comes from historical operating records, with operating conditions labeled by maintenance personnel for historical periods.

[0047] Step 4.2: Establish a library of differentiated baseline models for normal behavior; Differentiated normal behavior baseline models are established for each operating condition category, forming a baseline model library. The baseline model establishment process involves: selecting normal operating period data belonging to a specific operating condition category from historical data; calculating the statistical characteristics of time-series anomaly scores and topological anomaly scores for that operating condition, including mean, standard deviation, and quantiles. The baseline models are stored in the form of statistical features, with each operating condition corresponding to a set of statistical feature parameters. The baseline model library is updated periodically to adapt to the slow changes in system operating characteristics, with an optimal update cycle of thirty days. During updates, an incremental learning approach is used, weighting and fusing the statistical characteristics of new data with historical baselines. The fusion weights are set according to the timeliness of the data, with more recent data receiving higher weight.

[0048] Step 4.3: Dynamically calculate the anomaly detection threshold based on the operating conditions; Based on the current operating condition classification results obtained in step 4.1, a corresponding baseline model is selected from the baseline model library, and the anomaly detection threshold is dynamically calculated. The threshold calculation uses a statistical distribution-based method, where the threshold is obtained by adding the product of the baseline mean and the baseline standard deviation. The coefficient takes different values ​​depending on the operating condition type: under normal operating conditions, the preferred coefficient value is 3, corresponding to a false alarm rate of approximately 0.3%; under extreme weather conditions, the preferred coefficient value is 5, relaxing the threshold to reduce false alarms caused by normal business fluctuations; under equipment maintenance conditions, the preferred coefficient value is 4; under peak load conditions, the preferred coefficient value is 3.5; and under system disturbance conditions, the preferred coefficient value is 4.5. The coefficient values ​​can be adjusted and optimized based on actual operating experience.

[0049] Step 4.4: Weighted fusion of temporal and topological anomaly scores; The temporal anomaly scores and topology anomaly scores are weighted and fused to calculate a comprehensive anomaly score. The comprehensive anomaly score is obtained by adding the product of the temporal weight and the temporal anomaly score to the product of the topology weight and the topology anomaly score. The weighting coefficients are dynamically adjusted according to the current operating conditions: under normal operating conditions, both the temporal and topology weights are 0.5, indicating that both detection methods are equally important; under extreme weather conditions, the temporal weight decreases to 0.3, while the topology weight increases to 0.7, because extreme weather has a greater impact on temporal patterns but a smaller impact on topology; under equipment maintenance conditions, the topology weight decreases to 0.3, because reasonable changes to the network topology may occur during maintenance. The weighting adjustment strategy can be optimized based on actual detection results.

[0050] Step 4.5: Compare thresholds to generate preliminary anomaly alarms; The overall anomaly score is compared with an adaptive threshold to generate an initial anomaly alarm. When the overall anomaly score exceeds the threshold, an anomaly alarm is triggered. Alarm information includes attributes such as alarm time, alarm level, anomaly score, involved devices, and anomaly type. Alarm levels are classified according to the degree to which the anomaly score exceeds the threshold: within one standard deviation of the threshold is a low-level alarm, exceeding one to two standard deviations is a medium-level alarm, and exceeding two standard deviations is a high-level alarm. For alarms triggered in multiple consecutive time windows, alarm aggregation processing is performed, merging them into a single continuous alarm, recording information such as alarm start time, duration, and peak anomaly score.

[0051] Step 4.6: Differentiate between attacks and malfunctions / abnormalities; An attack and fault differentiation module is introduced to determine the cause of triggered abnormal alarms, distinguishing between anomalies caused by network attacks and those caused by equipment failures. The differentiation is based on the spatiotemporal and correlation characteristics of the anomalies. Regarding spatiotemporal characteristics: network attacks typically exhibit multi-point coordination and gradual penetration, with anomalies showing phased evolution over time and cross-device diffusion spatially; equipment failures typically manifest as single-point bursts, with anomalies concentrated in specific devices or areas and strongly correlated with physical location. Regarding correlation characteristics: the anomaly patterns of network attacks show a high similarity to patterns in a known attack signature database; equipment failure anomalies are usually accompanied by related events such as equipment alarm signals and protection action records. The differentiation module employs a combination of rule-based reasoning and machine learning. It makes an initial judgment based on expert rules, followed by fine-tuning using a trained classification model. The classification model outputs attack and failure probabilities, and the higher probability is selected as the final judgment.

[0052] The system outputs comprehensive anomaly detection results, including: a comprehensive anomaly score sequence, a list of anomaly alarms, and the cause determination result for each alarm. Alarms identified as attacks proceed to the subsequent threat intelligence correlation analysis process; alarms identified as faults are forwarded to the device operation and maintenance system for fault handling. The comprehensive anomaly detection results are also stored in the security event database for subsequent statistical analysis and model optimization.

[0053] The threat intelligence analysis module is used to construct a knowledge graph of threats to power industrial control systems, perform threat intelligence analysis based on comprehensive anomaly detection results, and obtain threat intelligence correlation analysis results. Based on the list of abnormal alarms identified as attacks, and combined with a pre-built knowledge graph of power industrial control threats, alarm events are mapped to attack technology entities in the knowledge graph. Graph embedding technology and knowledge reasoning algorithms are used for correlation analysis to infer the attacker's tactical intent, attack path, and possible subsequent attack actions, thus obtaining threat intelligence correlation analysis results.

[0054] Step 5.1: Construct a knowledge graph of threats to power industrial control systems; This paper constructs a threat knowledge graph for the power industrial control field, defining its ontology model and entity relationships. The ontology model is designed with reference to the MITRE ATT&CK for ICS framework. Defined entity types include: attack tactic entities, representing the attacker's high-level objectives, such as initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, and impact; attack technique entities, representing the specific methods for implementing attack tactics, such as spear phishing, remote service exploitation, scheduled tasks, process injection, and protocol tunneling; attack tool entities, representing the malware or tools used by the attacker, such as specific remote control Trojans and vulnerability exploitation tools; vulnerability entities, representing exploitable security flaws, including attributes such as vulnerability ID, affected products, and severity level; threat actor entities, representing known attack organizations or individuals; attack target entities, representing the type of device or system targeted by the attack; and defense measure entities, representing available security protection measures. Defined relationship types include: tactics including techniques, tools used by techniques, vulnerabilities exploited by techniques, techniques adopted by actors, targets targeted by techniques, and mitigation measures.

[0055] Step 5.2: Obtain threat intelligence from multiple sources to populate the knowledge graph; Threat intelligence data is acquired from multiple sources to populate the entities and relationships in the knowledge graph. Data sources include: publicly available vulnerability databases, such as the National Information Security Vulnerability Database and the General Vulnerability Disclosure Database, to obtain vulnerability entities and their attributes; publicly available threat intelligence reports, such as APT analysis reports released by security vendors and industry security incident reports, to extract entities such as attack techniques, attack tools, and threat actors, as well as their relationships; internal security incident databases within the power industry to obtain historical attack cases targeting the power system; and industrial control system security research literature to obtain technical details of industrial control protocol vulnerabilities and attack methods.

[0056] After data acquisition, it undergoes processing steps such as entity recognition, relation extraction, and entity alignment, and is then converted into a knowledge graph in the form of triples for storage. The knowledge graph is updated regularly to incorporate newly discovered threat intelligence, with an optimal update cycle of seven days.

[0057] Step 5.3: Map the abnormal alerts to the attack technology entities; Anomaly alerts are mapped to attack technique entities in a knowledge graph. The mapping process is based on matching alert features with attack technique features. Alarm features include: the type of industrial control protocol involved, the abnormal function code or operation type, the target device type, the timing pattern of the anomaly, and the topology pattern of the anomaly. Attack technique features are obtained from the attributes of technical entities in the knowledge graph, including technical descriptions, applicable protocols, and typical characteristics.

[0058] The matching algorithm employs a feature vector similarity-based approach: alarm features and technical features are encoded into vector representations respectively. The encoding method uses word embedding followed by mean calculation for text features and one-hot encoding for category features. The cosine similarity between the alarm feature vector and each technical feature vector is calculated. Technical entities with similarity exceeding a preset threshold are selected as the matching results, with a preferred threshold value of 0.7. A single alarm may match multiple attack techniques, indicating that the abnormal behavior may correspond to various attack methods.

[0059] Step 5.4: Generate entity vector representations using graph embedding techniques; Graph embedding technology is employed to map entities and relations in a knowledge graph to a low-dimensional vector space, providing a vector representation foundation for subsequent knowledge reasoning. The graph embedding uses the TransE model, whose basic idea is to model relations as translation operations in the entity vector space. For a correct triple, the sum of the head entity vector and the relation vector should approximately equal the tail entity vector. The training objective of the TransE model is to minimize the score function value of correct triples while maximizing the score function value of incorrect triples. The score function is defined by calculating the norm of the difference between the sum of the head entity vector and the relation vector and the tail entity vector. Training uses stochastic gradient descent, and negative samples are generated by randomly replacing the head or tail entity of the correct triple. The optimal embedding vector dimension is 128, and the optimal number of training rounds is 1000. After training, each entity and relation corresponds to a low-dimensional vector representation.

[0060] Step 5.5: Perform attack chain reasoning and subsequent action prediction; Knowledge reasoning is performed based on graph embedding vectors to infer attack chains and subsequent attack actions related to the current alert. The reasoning process includes two directions: attack path backtracking and attack action prediction. Attack path backtracking: Starting from the matched attack technology entity, the system traverses backward along the relation edges in the knowledge graph to find possible preceding attack technologies and initial intrusion points, constructing attack path hypotheses. The association strength of each entity on the path is calculated using graph embedding vectors, defined as the cosine similarity of adjacent entity vectors. Paths with high association strength are selected as possible attack paths. Attack action prediction: Starting from the matched attack technology entity, the system traverses forward along the relation edges in the knowledge graph to find possible subsequent attack technologies and the final attack target. Missing relationships are predicted using graph embedding vectors, i.e., the distance between the current technology entity vector and other technology entity vectors is calculated after adding various relation vectors; the entity with the closest distance is selected as the predicted subsequent attack technology.

[0061] Step 5.6: Generate a threat intelligence correlation analysis report; Based on the combined alert mapping results and knowledge inference results, a threat intelligence correlation analysis report is generated. The report includes: attack technique identification, listing the matched attack techniques and their confidence levels; attack tactic judgment, determining the attacker's current attack stage based on the tactical category of the matched techniques; attack intent inference, predicting the attacker's final target based on the attack path; subsequent attack prediction, listing possible subsequent attack techniques and their probabilities; threat actor association, listing possible attack organizations if the matched attack techniques are associated with known threat actors; and recommended defense measures, listing effective defense measures against the current attack techniques based on mitigation relationships in the knowledge graph. The report is output in a structured format for easy automated processing and manual review.

[0062] The system outputs threat intelligence correlation analysis results, including: a list of attack technique tags, attack tactical stages, attack intent descriptions, a list of predicted subsequent attacks, and a list of recommended defensive measures. This information serves as crucial input for optimizing subsequent defense strategies, guiding the defense system to take targeted response measures. Simultaneously, the analysis results are pushed to the work interface of security operations personnel to assist in manual decision-making.

[0063] The defense strategy optimization module optimizes the defense strategy based on the comprehensive anomaly detection results and threat intelligence correlation analysis results to obtain the optimal defense action sequence. Specifically, it includes the following: Step 6.1: Model a constrained Markov decision process; The defense strategy optimization problem is modeled as a constrained Markov decision process, defining a state space, action space, state transition function, reward function, and constraint function. The state space is defined by the following dimensions: threat level, divided into five levels based on a comprehensive anomaly score. The classification criteria are as follows: a comprehensive anomaly score less than 0.2 indicates no threat (value 0); a comprehensive anomaly score between 0.2 and 0.4 indicates low threat (value 1); a comprehensive anomaly score between 0.4 and 0.6 indicates medium threat (value 2); a comprehensive anomaly score between 0.6 and 0.8 indicates high threat (value 3); and a comprehensive anomaly score greater than 0.8 indicates severe threat (value 4). The thresholds for level classification are determined statistically based on the severity of historical attack events to ensure a relatively balanced sample distribution across levels.

[0064] The attack phase status is determined based on the attack tactics. The attack phase includes 11 phases: initial access phase, execution phase, persistence phase, privilege escalation phase, defense and evasion phase, credential access phase, discovery phase, lateral movement phase, collection phase, command and control phase, and impact phase. Each phase corresponds to a category code.

[0065] The status of affected devices is recorded, including a list of currently detected abnormal devices and their degree of abnormality. The device list is represented by an array of device identifiers, and the degree of abnormality is represented by a value between 0 and 1, which is equal to the normalized value of the abnormality score of the device.

[0066] Network connectivity status records the connectivity and traffic levels between different network regions. Connectivity is represented by an adjacency matrix, where a matrix element of 1 indicates connectivity and 0 indicates disconnection. Traffic levels are represented by normalized traffic rates.

[0067] Historical defense status records the most recently executed defense actions and their effects. A fixed-length historical window is used, with the preferred window length being 5 time steps. Each time step records the type of action executed and the change in threat level after the action is executed.

[0068] Resource availability status records currently available defense resources. For example, the capacity of the backup isolation zone is represented by the ratio of used capacity to total capacity, and the honeypot system load is represented by the ratio of current processing traffic to maximum processing capacity. The state vector is formed by encoding each dimension and then concatenating them. The encoding method uses one-hot encoding for categorical states and normalization for numerical states.

[0069] Step 6.2, define the space for multiple types of defensive actions; The defense action space is defined, encompassing various types of defense response measures. Action types include: access control adjustment actions, such as tightening access permissions for specific devices or areas, blocking communication from specific source or destination addresses, and restricting access to specific protocols or ports; network isolation actions, such as isolating suspicious devices in independent isolation zones, disconnecting connections between specific network areas, and enabling backup communication links; traffic rate limiting actions, such as imposing rate limits on specific traffic types and enabling traffic scrubbing services; honeypot inducement actions, such as redirecting suspicious traffic to honeypot systems and deploying decoy assets in the network; proactive attribution actions, such as initiating traffic backtracking analysis and triggering deep forensic data collection; and alarm escalation actions, such as reporting to the superior security operations center and triggering emergency response procedures. Each action type contains multiple specific action options, and the total dimension of the action space is determined based on the action type and the number of options.

[0070] Step 6.3, Design the comprehensive reward function; Design a reward function to comprehensively evaluate the security benefits and business impact of defensive actions. The reward function is a weighted combination of security benefits minus business impact minus resource consumption.

[0071] The calculation of security benefits is based on the change in threat level after the defensive action is executed. The specific calculation process is as follows: record the threat level value before the action is executed, with threat levels ranging from 0 to 4 corresponding to no threat to severe threat. Record the threat level value after the action is executed, and calculate the difference between the two as the change in threat level. If the change is positive, it means that the threat level has decreased, and the security benefit is equal to the change multiplied by the base reward value, which is preferably 10. If the change is negative, it means that the threat level has increased, and the security benefit is equal to the change multiplied by the penalty coefficient, which is preferably 20. If the change is zero, the security benefit is 0.

[0072] The calculation of the business impact item is based on the degree of interference of the defensive action to normal business. The specific calculation process is as follows: Calculate the business traffic change rate before and after the action is executed. The change rate is equal to the traffic after execution minus the traffic before execution, and then divided by the traffic before execution. Check the availability of critical services. Availability is defined as the proportion of critical services that respond successfully. Calculate the decrease in availability. The business impact item is equal to the absolute value of the traffic change rate multiplied by the traffic weight plus the decrease in availability multiplied by the availability weight. The preferred value for the traffic weight is 5, and the preferred value for the availability weight is 15.

[0073] The calculation of resource consumption is based on the various resources consumed by defensive actions. The specific calculation process is as follows: The computational resources consumed by the actions are statistically analyzed, such as CPU utilization and memory usage; the network resources consumed are statistically analyzed, such as bandwidth usage; and the human resources consumed are statistically analyzed, such as the time required for manual intervention. The resource consumption item equals the sum of the products of each type of resource consumption and its corresponding weight. The preferred weight values ​​are 0.5 for resources, 0.3 for network resources, and 1.0 for human resources. The final reward function equals the security benefit weight multiplied by the security benefit item, minus the business impact weight multiplied by the business impact item, and then minus the resource consumption weight multiplied by the resource consumption item. The weight coefficients for each item are set according to the priority of the security policy. In the optimal scenario, the security benefit weight is 1.0, the business impact weight is 0.5, and the resource consumption weight is 0.1.

[0074] Step 6.4: Design business security constraints; Design security constraints to ensure that defensive actions do not have an unacceptable impact on critical business operations. Constraints are defined as business impact assessment function values ​​not exceeding a preset maximum impact threshold.

[0075] The business impact assessment function considers the following factors: availability of critical control loops to ensure that key functions such as generator control, grid connection control, and protection interlocking are unaffected; connectivity of dispatch communication to ensure uninterrupted communication links with the superior dispatch center; and integrity of data acquisition to ensure that data from key monitoring points can be transmitted normally. Business importance is classified into three levels: Level 1 important businesses include core businesses such as generator control, grid connection control, and protection interlocking, which are not allowed to be affected in any way; Level 2 important businesses include important businesses such as dispatch communication and remote control / adjustment, which are allowed to have a slight impact; and Level 3 important businesses include auxiliary businesses such as historical data queries and statistical reports, which are allowed to have a certain degree of impact. The business level is determined by querying a pre-established business level mapping table, which is formulated by power system operation experts according to industry standards. The maximum impact threshold is set according to the business importance level: Level 1 business threshold is 0, Level 2 business threshold is 0.5, and Level 3 business threshold is 2.0.

[0076] Step 6.5: Construct a deep neural network policy network; A deep neural network is constructed as the policy network, taking the current state vector as input and outputting the probability of selecting each defensive action. The policy network employs a multi-layer fully connected structure, including an input layer, multiple hidden layers, and an output layer. The input layer dimension equals the state vector dimension, the optimal number of hidden layers is three, the optimal number of neurons in each layer is 256, and the activation function is a modified linear unit (MRU). The output layer dimension equals the action space dimension, and the activation function is a softmax function, converting the output into a probability distribution. The parameters of the policy network are trained using a constrained policy optimization algorithm.

[0077] Step 6.6: Train the policy network using a constrained policy optimization algorithm; A constrained policy optimization algorithm is used to train the policy network, maximizing the cumulative reward while satisfying safety constraints. The core idea of ​​the constrained policy optimization algorithm is to ensure that the updated policy satisfies the constraints by solving a constraint optimization problem at each policy update.

[0078] The specific training process is as follows: The system interacts with the environment using the current policy, collecting trajectory data on state, action, reward, and constraint cost; the policy gradient and constraint gradient are calculated, with the policy gradient pointing in the direction of increasing reward and the constraint gradient pointing in the direction of satisfying constraint; a quadratic programming problem is solved to find the maximum step size that satisfies the constraints in the policy gradient direction; the policy network parameters are updated according to the calculated step size. During training, a generalized dominance estimation method is used to calculate the dominance function, reducing the variance of the gradient estimation.

[0079] Step 6.7: Design a two-layer defense architecture to ensure operational safety; A two-layer defense architecture is designed to ensure the security and controllability of defensive actions output by reinforcement learning. The first layer is the policy network output layer, which generates defensive action suggestions based on the current state. The second layer is the security constraint checking layer, which verifies the security of the actions output by the policy network. The security constraint checking layer includes a rule checking module and an impact assessment module. The rule checking module performs compliance checks on actions based on predefined security rules, including: prohibiting the simultaneous isolation of multiple critical devices, prohibiting large-scale access control adjustments during peak load periods, and prohibiting the disconnection of the main communication link with the scheduling center. The impact assessment module estimates the business impact after the action is executed based on a business impact model. If the estimated impact exceeds a threshold, the action is rejected. Only actions that pass the two-layer checks can enter the execution queue.

[0080] Step 6.8: Establish an action rollback mechanism; Establish an action rollback mechanism to monitor the system status after defensive actions are executed and automatically roll back in case of anomalies. Before an action is executed, the system automatically saves the current network configuration state as a rollback point, including access control rules, routing configurations, and isolation zone status. After the action is executed, business operation metrics are continuously monitored, including key service response time, data acquisition success rate, and communication link packet loss rate. If a monitored metric deteriorates abnormally within the observation window after the action is executed, and the degree of deterioration exceeds a preset threshold, a rollback operation is automatically triggered to restore the network configuration to the rollback point state. The preferred observation window length is sixty seconds, and the deterioration threshold is set according to the metric type. After the rollback operation is executed, the action is marked as a failure and feedback is sent to the policy network for subsequent learning.

[0081] The output is the optimal sequence of defense actions verified by security constraints, including: defense action type, action parameters, execution priority, and expected effect. Defense actions are executed sequentially according to priority, with higher-priority actions executed first. The execution results are fed back to the reinforcement learning module to update the policy network and optimize subsequent decisions.

[0082] The self-evolutionary learning module, based on the optimal defense action sequence, drives the continuous evolution of threat detection and defense strategies to obtain adaptive security protection strategies; Based on historically accumulated attack sample data and attack type condition information, a conditional Wasserstein generative adversarial network is constructed to generate diverse simulated attack scenario data. High-quality samples are selected through a sample quality evaluation mechanism and added to the training dataset. The temporal anomaly detection strategy, topology anomaly detection strategy, and reinforcement learning defense strategy are retrained. A performance monitoring and automatic retraining mechanism is established to obtain the evolved threat detection strategy and defense response strategy.

[0083] Step 7.1: Collect and organize historical attack samples to build a database; Historical attack sample data is collected and organized to construct an attack sample database. Attack samples originate from: attack traffic data collected during actual security incidents, stored after anonymization; attack data generated during security drills and penetration tests; publicly available industrial control system (ICS) security datasets, such as ICS intrusion detection datasets; and attack samples shared by security research institutions. Each attack sample includes attributes such as raw traffic data, protocol parsing results, attack type tags, attack stage tags, and target device type. Attack type tags are labeled using the MITRE ATT&CK for ICS framework, including major categories such as initial access, execution, persistence, lateral movement, and impact, as well as specific attack techniques within each category. The attack sample database is regularly updated to include newly discovered attack types and variants.

[0084] Step 7.2: Construct a conditional Wasserstein generative adversarial network; A conditional Wasserstein generative adversarial network is constructed, consisting of a generator network and a discriminator network. The generator network takes a concatenation of a random noise vector and an attack type conditional vector as input, and outputs a feature vector of the generated simulated attack traffic. The random noise vector is sampled from a standard normal distribution, with an optimal dimension of 100. The attack type conditional vector uses one-hot encoding to represent the attack type label, with a dimension equal to the number of attack types. The generator network employs a multi-layer fully connected structure, including an input layer, multiple hidden layers, and an output layer. The optimal number of hidden layers is four, with each layer containing 256, 512, 512, and 256 neurons respectively. The activation function is a leak-corrected linear unit, and the output layer activation function uses a hyperbolic tangent function to map the output to the range of -1 to 1. The discriminator network takes the feature vectors of real attack samples or generated samples as input, and outputs a sample authenticity score. The discriminator network also employs a multi-layer fully connected structure, with hidden layers configured symmetrically to the generator. The output layer does not use an activation function and directly outputs the score value.

[0085] Step 7.3: Train using Wasserstein distance and gradient penalty; Wasserstein distance is used as the training objective for generative adversarial networks (GANs), and a gradient penalty term is introduced to ensure training stability. Compared to the traditional Jensen-Shannon divergence, Wasserstein distance has better gradient properties, which can alleviate the mode collapse problem during GAN training.

[0086] The training objective is defined as maximizing the difference between the discriminator's expected scores for real samples and its expected scores for generated samples, while minimizing the negative values ​​of the discriminator's scores for generated samples. A gradient penalty term constrains the discriminator's gradient norm to be close to 1. The penalty term is obtained by calculating the square of the difference between the discriminator's gradient norm and 1 at random interpolation points of real and generated samples, with an optimal penalty coefficient of 10. During training, the discriminator and generator are updated alternately. Before each generator update, the discriminator is updated 5 times to ensure sufficient training of the discriminator.

[0087] Step 7.4 introduces conditional batch normalization to achieve targeted generation; A conditional information control mechanism is introduced into the generator to achieve targeted generation of samples for specific attack types. Conditional control is implemented through a conditional batch normalization layer, which dynamically adjusts the normalization parameters based on the conditional vector. Specifically, the conditional batch normalization layer performs standard batch normalization on the input features, generates scaling and offset parameters through a linear transformation based on the conditional vector, and multiplies the normalized features by the scaling parameters and adds the offset parameters. In this way, different attack type conditions lead to different feature transformations, thereby generating samples with different attack characteristics. When generating samples, a specific attack type conditional vector can be specified to generate attack samples of that type; alternatively, conditional vectors can be randomly sampled to generate diverse attack samples.

[0088] Step 7.5: Design a multi-dimensional quality assessment mechanism to screen samples; A quality assessment mechanism for generated samples is designed to screen high-quality generated samples for policy training. The quality assessment is conducted across three dimensions: distribution similarity assessment, which calculates the Fréchet distance between the generated sample set and the real sample set; a smaller Fréchet distance indicates that the distribution of the generated samples is closer to that of the real samples. The calculation method is the trace of the square root of the product of the two distributions minus the sum of the differences in the means of the two distributions and the sum of the covariance matrices of the two distributions. Detection effectiveness assessment involves inputting the generated samples into the existing threat detection strategy and statistically analyzing the proportion of samples correctly detected as attacks; a low detection rate indicates that the generated samples lack attack characteristics, while a high detection rate indicates that the generated samples are too simple. Diversity assessment involves calculating the average pairwise distance within the generated sample set; a larger distance indicates better sample diversity. Based on the combined assessment results of these three dimensions, a quality threshold is set to screen high-quality samples. The quality threshold is determined according to the historical statistical values ​​of each dimension.

[0089] Step 7.6: Retrain the detection and defense strategies using the generated samples; High-quality generated samples, after screening, are added to the training dataset to retrain the threat detection and defense response strategies. For the temporal anomaly detection strategy, generated attack samples are added to the training set as anomalous samples, and a contrastive learning method is used to train the strategy to distinguish between normal and anomalous samples. For the topology anomaly detection strategy, corresponding anomalous topology patterns are constructed based on the attack types of the generated samples and added to the training data of the graph neural network. For the reinforcement learning defense strategy, a simulated environment is constructed using generated attack scenarios, allowing the policy network to explore and learn in the simulated environment and accumulate defense experience against various attacks. The strategy retraining adopts an incremental learning approach, continuing training based on the original parameters to avoid the high cost of training from scratch.

[0090] Step 7.7: Establish a strategy performance monitoring mechanism; Establish a strategy performance monitoring mechanism to continuously evaluate the performance of each strategy based on actual data. Monitoring metrics include: detection rate, false positive rate, and false negative rate of threat detection strategies; average response time, defense success rate, and business impact of defense response strategies. Monitoring data comes from actual detection results and defense effectiveness statistics during operation. Set performance degradation alarm thresholds; when monitoring metrics fall below the threshold for multiple consecutive periods, an alarm is triggered. Alarm information includes the strategy experiencing performance degradation, the magnitude of the degradation, and possible cause analysis. Possible causes of performance degradation include: changes in attack patterns, changes in normal business patterns, and data distribution drift.

[0091] Step 7.8: Establish an automatic retraining trigger mechanism; An automatic retraining mechanism is established to automatically trigger the policy update process when a performance degradation is detected. Retraining trigger conditions include: performance monitoring alarms, the arrival of a scheduled retraining cycle, and the accumulation of new attack type samples reaching a threshold. The retraining process includes: a data preparation phase, collecting the latest training data, including real and generated samples; a policy training phase, updating policy parameters using incremental learning or full retraining; a policy validation phase, evaluating the performance of the new policy on a validation dataset to ensure its performance is not lower than the original policy; and a policy deployment phase, deploying the validated new policy to the production environment to replace the original policy. The retraining process adopts a canary release strategy, deploying and running the new policy on a subset of nodes first, observing for a period without anomalies before full deployment.

[0092] Step 7.9: Deploy the update strategy to complete the evolutionary iteration; The updated threat detection and defense response strategies are deployed to the system, completing an evolutionary iteration and outputting an adaptive security protection strategy. This adaptive strategy possesses the ability to detect and defend against new attack patterns, thereby improving the overall security level of the system. Strategy update records are stored in the version management system, including update time, reason for update, strategy version, performance metrics, and other information, facilitating subsequent auditing and backtracking.

[0093] A computer-readable storage medium for storing computer-readable instructions that, when read by a computer, enable the execution of the aforementioned AI-based power industrial control network threat detection and self-evolving defense system.

[0094] In one embodiment of the present invention, a specific example is provided: A 90-day field test was conducted at a new energy base in Northwest China. During the test, a distributed threat detection system covering eight wind farms and five photovoltaic power stations was deployed, covering an area of ​​approximately 300 square kilometers and a total installed capacity exceeding 3 gigawatts. Each power station was interconnected with the regional dispatch center via a dedicated fiber optic network. Twenty-three traffic acquisition probes were deployed at key network nodes, and 15 edge computing servers were deployed at each site for local data preprocessing and anomaly detection. The test included various operating conditions such as normal operation, cold wave weather, equipment maintenance, and peak load. The system collected over 500 terabytes of network traffic data and over 200 million records of equipment operation data.

[0095] Table 1 shows examples of multi-source heterogeneous data acquired by the system during the data acquisition phase: Table 1: Examples of multi-source heterogeneous data acquired during the data acquisition phase; Table 2 shows an example of anomaly detection results data obtained by the system during the threat detection phase: Table 2: Examples of anomaly detection results obtained during the threat detection phase; During a cold wave, the system of this invention detected a cyberattack targeting the base and successfully implemented defense. Based on the detection results, the system automatically generated and executed defense strategies, including: limiting traffic flow to communication gateway A, redirecting suspicious traffic to the honeypot system, and tightening access permissions for the wind turbine controller group. After the defense actions were executed, the threat level decreased from high to low, while business operation indicators remained normal, and the availability of critical control loops remained above 99.8%, verifying the effectiveness of the method of this invention.

[0096] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. An AI power industrial control network threat detection and self-evolution defense system, characterized in that, The method comprises the following steps: a data acquisition and preprocessing module for acquiring and preprocessing multi-source heterogeneous data of the industrial control network to obtain a standardized fusion feature vector sequence; a time series anomaly detection module for constructing a time series anomaly detection model to detect time series anomalies in the standardized fusion feature vector sequence and obtain a time series anomaly score sequence; a topology anomaly detection module for constructing a network topology graph model to detect topology anomalies in the standardized fusion feature vector sequence and obtain a topology anomaly score; a comprehensive anomaly judgment module for calculating an anomaly detection threshold, calculating a comprehensive anomaly score based on the time series anomaly score sequence and the topology anomaly score, and obtaining a comprehensive anomaly detection result; a threat intelligence analysis module for constructing an industrial control threat knowledge graph, performing threat intelligence analysis based on the comprehensive anomaly detection result, and obtaining a threat intelligence correlation analysis result; a defense strategy optimization module for optimizing a defense strategy based on the comprehensive anomaly detection result and the threat intelligence correlation analysis result, and obtaining an optimal defense action sequence; an evolutionary learning module for driving continuous evolution of threat detection and defense strategies based on the optimal defense action sequence, and obtaining an adaptive security protection strategy.

2. The AI electric power industrial control network threat detection and self-evolution defense system according to claim 1, characterized in that, The data acquisition and preprocessing module comprises: a primary time server is deployed in the regional dispatch center, a time reference is obtained through a satellite time system, a secondary time server is deployed in each new energy station, time synchronization is performed with the primary time server, and each data acquisition node is used as a tertiary time client to synchronize with the secondary time server of the station; a flow acquisition probe is deployed, network flow data is acquired in a port mirroring mode, and the acquired raw flow data comprises Ethernet frame header information, network layer protocol header information, transmission layer protocol header information and application layer load data; deep protocol analysis is performed on the acquired industrial control protocol message, feature information at the protocol semantic level is extracted, and the protocol analysis result is stored in a structured format. 3.The AI electric power industrial control network threat detection and self-evolution defense system of claim 2, wherein, The data acquisition and preprocessing module further comprises: time alignment processing is performed on the multi-source heterogeneous data, a unified time window length is set, and all data is distributed to the corresponding time window according to the time stamp; for data with a collection frequency higher than the window frequency, down-sampling is performed in the window; for data with a collection frequency lower than the window frequency, up-sampling is performed by using a linear interpolation method; and for missing data, a forward filling method is used for filling; feature engineering and standardization processing are performed on the time-aligned multi-source data, numerical features are standardized by using a Z-score standardization method, category features are converted into numerical vectors by using a one-hot encoding method, and all features are spliced to form a unified feature vector.

4. The AI electric power industrial control network threat detection and self-evolution defense system of claim 1, wherein, The time series anomaly detection module comprises: an input embedding layer of a lightweight Transformer encoder is constructed to convert the standardized fusion feature vector sequence into an embedding representation that can be processed by the model; the input embedding layer comprises a feature projection sublayer and a position encoding sublayer, the feature projection sublayer projects the original feature vector into a model hidden dimension space by using linear transformation, and the position encoding sublayer generates a position embedding vector for each position in the sequence by using a learnable relative position encoding method; An auto-attention layer based on a linear attention mechanism is constructed, a feature mapping function is used to map query vectors and key vectors to a non-negative space, the calculation order is adjusted, and the complexity is reduced from being proportional to the square of the sequence length to being linearly related to the sequence length; A Transformer decoder is constructed to reconstruct the original input sequence, and the mean square error between the original feature vector and the reconstructed feature vector is calculated as the time series anomaly score.

5. The AI electric power industrial control network threat detection and self-evolution defense system according to claim 1, characterized in that, The topological anomaly detection module comprises: A network topology graph is constructed, which is defined as a combination of a node set and an edge set, each node in the node set represents a device or system in the network, and each edge in the edge set represents a communication connection relationship between two devices; A feature vector is initialized for each node in the network topology graph, and the node feature vector is composed of static attribute features and dynamic behavior features; A graph neural network architecture based on neighbor sampling is used for node embedding learning, a predetermined number of nodes are randomly sampled from the first-order neighbors of each target node, and a predetermined number of second-order neighbors are sampled from the neighbors of the first-order neighbors. A neighbor aggregation layer of the graph neural network is constructed to update the representation of the target node by aggregating the feature information of the neighbor nodes. An anomaly detection module is added after the output layer of the graph neural network, and an isolation forest algorithm is used to score the node embedding vector for anomaly.

6. The AI electric power industrial control network threat detection and self-evolution defense system of claim 1, wherein, The comprehensive anomaly judgment module comprises: An operating condition classification model is constructed, the current operating condition is classified into predefined operating condition categories according to meteorological environment data and device operating state data, and the operating condition categories include normal operating conditions, extreme weather conditions, device maintenance conditions, load peak conditions, and system disturbance conditions; A differentiated normal behavior baseline model is established for each operating condition category to form a baseline model library, normal operating period data belonging to a specific operating condition category is selected from historical data, and statistical features of time series anomaly scores and topological anomaly scores are calculated; According to the current operating condition classification result, the corresponding baseline model is selected from the baseline model library, the anomaly detection threshold is dynamically calculated, and the coefficient takes different values according to the operating condition type; The time series anomaly score and the topological anomaly score are weighted and fused to calculate the comprehensive anomaly score.

7. The AI electric power industrial control network threat detection and self-evolution defense system of claim 1, wherein, The threat intelligence analysis module comprises: A threat knowledge graph in the power industrial control field is constructed, an ontology model and entity relationships of the knowledge graph are defined, entity types include attack tactic entities, attack technology entities, attack tool entities, vulnerability entities, threat actor entities, attack target entities, and defense measure entities, and relationship types include tactic containing technology, technology using tool, technology exploiting vulnerability, actor adopting technology, technology targeting target, and measure mitigating technology; Abnormal alarms are mapped to attack technology entities in the knowledge graph, alarm features and technology features are respectively encoded into vector representations, cosine similarities between alarm feature vectors and technology feature vectors are calculated, and technology entities with similarity exceeding a preset threshold are selected as matching results; Graph embedding technology is used to map entities and relationships in the knowledge graph to a low-dimensional vector space, knowledge reasoning is performed based on the graph embedding vectors, and attack chains and subsequent attack actions related to the current alarm are inferred. 8.The AI electric power industrial control network threat detection and self-evolution defense system of claim 1, wherein, The defense strategy optimization module comprises: The defense strategy optimization problem is modeled as a constrained Markov decision process, defining state space, action space, state transition function, reward function and constraint function; Define the defense action space, including access control adjustment action, network isolation action, traffic speed limit action, honeypot induction action, active tracing action, alarm escalation action; Design the reward function, which is composed of the weighted combination of security income, business impact and resource consumption; Design the security constraint condition, which is defined as the business impact evaluation function value not exceeding the preset maximum impact threshold; Build a deep neural network as a policy network, and train the policy network using a constraint policy optimization algorithm to maximize the cumulative reward under the premise of meeting the security constraints.

9. The AI electric power industrial control network threat detection and self-evolution defense system of claim 1, wherein, The self-evolution learning module comprises: Build an attack sample database, each attack sample containing original traffic data, protocol analysis results, attack type label, attack stage label, target device type; Build a conditional Wasserstein generative adversarial network, including a generator network and a discriminator network, the input of the generator network being the splicing of random noise vector and attack type condition vector, and the output being the generated simulated attack traffic feature vector; Use the Wasserstein distance as the training target of the generative adversarial network, and introduce a gradient penalty term to ensure training stability; Introduce a conditional information control mechanism in the generator to realize directional generation of specific attack type samples, and realize conditional control through a conditional batch normalization layer; Design a generated sample quality evaluation mechanism to screen high-quality generated samples, and the quality evaluation is performed from three dimensions of distribution similarity evaluation, detection effectiveness evaluation and diversity evaluation; Add the screened high-quality generated samples to the training data set, and retrain the time series anomaly detection module, topology anomaly detection module and defense strategy optimization module; Establish a strategy performance monitoring mechanism and an automatic retraining triggering mechanism, and automatically trigger the strategy update process when the strategy performance is detected to be degraded.

10. A computer-readable storage medium, characterized in that, It is used for storing computer readable instructions, which can run an AI power industrial control network threat detection and self-evolution defense system as claimed in any of claims 1-9 when read by a computer.

Images