A Method and System for Power Grid Control Data Interface Access Control Based on Graph Neural Networks

Abstract

This invention relates to a method and system for access control of power grid control data interfaces based on graph neural networks, belonging to the field of anomaly detection technology, and solving the problem of overly simplistic and mechanical anomaly detection in existing technologies. The method includes: constructing a graph model of the power grid control data system using user nodes, data interface nodes, and data resource nodes from historical data; obtaining the edge weight access strength from the user node to be analyzed to the target resource node based on the constructed graph model; performing three-stage corrections on the attention coefficients based on causal constraints, adversarial robustness, and interpretability based on a graph attention neural network, obtaining the embedding vector representations of the user node to be analyzed and the target resource node; predicting the access control probability score of the user node to be analyzed to the target resource node based on the embedding vector representation and the edge weight access strength; and assigning corresponding operation permissions to the user node to be analyzed based on the probability score. This invention can effectively resist potential attacks and significantly improve the efficiency of power grid access control.

Description

Technical Field

[0001] This invention relates to the fields of information security and data access control technology, and in particular to a power grid regulation data interface access control method and system based on graph neural networks. Background Technology

[0002] The digital transformation of power systems brings convenience but also digital risks. The security and stability of power grid control data have become key factors in ensuring the reliable operation of the power grid. As the core hub of power grid operation, the power grid control system has extremely high requirements for the real-time performance of its data. Any minor anomaly can trigger a chain reaction, leading to power grid malfunctions or even large-scale power outages.

[0003] As the scale of power grid regulation continues to expand, the relationships between users, interfaces, and data resources become increasingly complex, making static access control relying solely on roles or attributes insufficient for accurate responses. Power grid regulation systems not only need to monitor the dynamic changes in user behavior in real time, but also need to identify potential attacks and high-risk access from a global perspective.

[0004] Advances in artificial intelligence have led to the emergence of solutions that use machine learning models to identify unreasonable user access behavior, enabling some basic intelligent access control. However, in power grid regulation and access control scenarios, simply identifying the association between user identity and resource type is clearly too simplistic. Further integration with causal filtering, attack defense, and interpretable analysis is needed to comprehensively detect users and their behaviors, and to achieve real-time updates of user nodes. This will enhance the identification and protection against abnormal access throughout the entire process—before, during, and after an event. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a power grid regulation data interface access control method and system based on graph neural networks, in order to solve the problem that the abnormal access detection in the prior art is too one-sided and mechanical.

[0006] On one hand, embodiments of the present invention provide a power grid control data interface access control method based on graph neural networks, the method comprising the following steps:

[0007] A graph model of the power grid control data system is constructed using user nodes, data interface nodes, and data resource nodes from historical data.

[0008] Input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to the target resource node.

[0009] Based on the graph attention neural network, the attention coefficients are corrected in three stages: causal constraint, adversarial robustness, and interpretability, to obtain the embedding vector representations of the user node to be analyzed and the target resource node.

[0010] Based on the embedded vector representation and the edge weight access strength, predict the access control probability score of the user node to be analyzed for the target resource node, and grant the user to be analyzed corresponding operation permissions based on the probability score.

[0011] Based on a further improvement of the above method, obtaining the edge weight access strength from the user node to be analyzed to the target resource node includes the following steps:

[0012] Based on the historical data of the user node i accessing the target resource node j, the edge weight access strength is calculated as follows:

[0013] ;

[0014] in, , , These are the weight coefficients for each item; Historical access frequency, For historical access success rate, For time decay, there is ; Indicates the current time. This represents the time of the k-th visit. This is the time decay factor.

[0015] Based on the above method, a further improvement, the three-stage correction of the attention coefficients based on graph attention neural networks for causal constraints, adversarial robustness, and interpretability includes the following steps:

[0016] The initial standard attention coefficients are obtained based on the original standard attention scores of any node and its neighbors in the graph model.

[0017] In the pre-defense phase, the causal constraint attention coefficient is obtained by applying a causal influence factor and a time mask constraint to the standard attention coefficient;

[0018] During the resistance phase, adversarial robust attention coefficients are generated through adversarial correction terms, and combined with the adversarial robust attention coefficients and the causal constraint attention coefficients to obtain the combined attention coefficients.

[0019] During the post-audit phase, the combined attention coefficient is adjusted based on each node's contribution to the access permission decision to obtain the interpretable attention coefficient.

[0020] Based on a further improvement to the above method, the method further includes the following steps:

[0021] The graph attention neural network adopts a multi-head attention mechanism, defining multiple parallel attention heads for each node. Each attention head performs the three-stage correction of causal constraints, adversarial robustness, and interpretability to obtain its own attention coefficient.

[0022] The embedding vector representation of each node is obtained by weighting and summing the feature vectors of its neighboring nodes using the attention coefficients of each attention head.

[0023] Based on further improvements to the above method, the attribute information of the user node includes user role, permission level, authentication status, access frequency, abnormal operation records, and session activity; the attribute information of the data interface node includes interface type, protocol, security level, current load, health status, and risk marker; the attribute information of the resource node includes data type, access control level, and data sensitivity; the method further includes the following steps:

[0024] The attribute information of each node is divided into text, numerical and binary types, and corresponding encoding processes are performed. The encoded attribute information is then concatenated to obtain the original embedding vector of each node.

[0025] Based on a further improvement to the above method, the method further includes the following steps:

[0026] For text-based information, a trainable embedding matrix is ​​used to encode the attribute information;

[0027] For numerical information, Z-score normalization is used.

[0028] For binary information, feature splicing is performed directly.

[0029] Based on a further improvement to the above method, the method further includes the following steps:

[0030] For the original embedding vectors of different types of nodes, a multilayer perceptron is used to map them to the same dimension to obtain the output embedding vectors of each node.

[0031] Based on a further improvement of the above method, the interpretability attention coefficient is expressed as:

[0032] ;

[0033] in, Let the initial standard attention coefficients be obtained based on any node i and its neighboring nodes j. These are causal influence factors generated based on interference analysis. For time mask, Let be the Shapley value of node j relative to node i. f( ) To counter the revision, Let be the specific perturbation term between node i and node j in the perturbation matrix. To combat the robust attention coefficient, softmax() This is the normalization function.

[0034] Based on a further improvement to the above method, the embedding vector of each node obtained by weighted summation is represented as follows:

[0035] ;

[0036] in, For iterative updates of node i and its neighboring nodes The embedding vector representation, Let M be the set of neighbors of node i; M be the total number of attention heads. This represents the weight matrix corresponding to the m-th attention head; The attention coefficient corresponding to the m-th attention head. This represents a vector concatenation operation. It is a non-linear activation function.

[0037] A further improvement to the above method, the step of predicting the access control probability score of the user node to be analyzed for the target resource node based on the embedded vector representation and the edge weight access strength, includes:

[0038] make and Let i and j represent the embedding vector representations of the user node i to be analyzed and the target resource node j, respectively. Given the edge weight access strength from the user node i to the target resource node j, the predicted access control probability score for the user node i to the target resource node j is as follows:

[0039] ;

[0040] The probability that the user node i to be analyzed accesses the target resource node j is:

[0041] ;

[0042] in, It is a non-linear activation function. sigmoid() The activation function is sigmoid; the transformation matrix is... U and w Used for performing the corresponding matrix calculations. This represents a vector concatenation operation. b This represents the function bias term.

[0043] Based on a further improvement to the above method, the method further includes the following steps:

[0044] Real-time monitoring and analysis of user behavior, and small-scale retraining only on nodes affected by the user behavior and their corresponding local subgraphs, to achieve incremental updates to the constructed graph model.

[0045] On the other hand, embodiments of the present invention provide a power grid control data interface access control system based on graph neural networks, the system comprising:

[0046] The graph model building module is used to build a graph model of the power grid control data system using user nodes, data interface nodes and data resource nodes from historical data.

[0047] The access strength calculation module is used to input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to be analyzed to the target resource node.

[0048] The attention correction module is used to perform three-stage correction of the attention coefficients based on graph attention neural network, namely causal constraint, adversarial robustness and interpretability, to obtain the embedding vector representation of the user node to be analyzed and the target resource node.

[0049] The access control module is used to predict the access control probability score of the user node to be analyzed to the target resource node based on the embedded vector representation and the edge weight access strength, and to grant the user to be analyzed corresponding operation permissions based on the probability score.

[0050] Based on further improvements to the above system, the access strength calculation module includes:

[0051] The strength calculation subunit is used to calculate the edge weight access strength based on the historical data of the user node i to be analyzed accessing the target resource node j:

[0052] ;

[0053] in, , , These are the weight coefficients for each item; Historical access frequency, For historical access success rate, For time decay, there is ; Indicates the current time. This represents the time of the k-th visit. This is the time decay factor.

[0054] Based on further improvements to the above system, the attention correction module includes:

[0055] The standard attention coefficient calculation unit is used to obtain the initial standard attention coefficient based on the original standard attention scores of any node and its neighbors in the graph model.

[0056] The causal correction unit is used to correct the standard attention coefficients to obtain causal constraint attention coefficients by applying causal influence factors and time mask constraints during the ex-ante defense phase.

[0057] The combined correction unit is used to generate adversarial robust attention coefficients through adversarial correction terms during the in-process resistance phase, and to combine the adversarial robust attention coefficients with the causal constraint attention coefficients to obtain the combined attention coefficients.

[0058] An interpretability correction unit is used to correct the combined attention coefficients during the post-audit phase by assessing each node's contribution to the access permission decision, thereby obtaining interpretable attention coefficients.

[0059] Based on further improvements to the above system, the system also includes:

[0060] A multi-head attention module is used to employ a multi-head attention mechanism in the graph attention neural network. Multiple parallel attention heads are defined for each node, and each attention head performs the three-stage correction to obtain its own attention coefficient.

[0061] The weighted summation module is used to perform weighted summation on the feature vectors of neighboring nodes using the attention coefficients of each attention head to obtain the embedding vector representation of each node.

[0062] Based on further improvements to the above system, the attribute information of the user node includes user role, permission level, authentication status, access frequency, abnormal operation records, and session activity; the attribute information of the data interface node includes interface type, protocol, security level, current load, health status, and risk marker; the attribute information of the resource node includes data type, access control level, and data sensitivity; the system also includes:

[0063] The encoding module is used to classify the attribute information of each node into text, numeric and binary types, perform corresponding encoding processing on each type, and then concatenate the encoded attribute information to obtain the original embedding vector of each node.

[0064] Based on further improvements to the above system, the encoding processing module includes:

[0065] The text encoding unit is used to encode attribute information using a trainable embedding matrix for textual information.

[0066] Numerical encoding unit, used for Z-score normalization processing of numerical information;

[0067] The binary processing unit is used to directly perform feature concatenation on binary information.

[0068] Based on further improvements to the above system, the system also includes:

[0069] The vector alignment module is used to map the original embedding vectors of different types of nodes to the same dimension through a multilayer perceptron, so as to obtain the output embedding vectors of each node.

[0070] Based on further improvements to the above system, the interpretability attention coefficient is expressed as:

[0071] ;

[0072] in, Let the initial standard attention coefficients be obtained based on any node i and its neighboring nodes j. These are causal influence factors generated based on interference analysis. For time mask, Let be the Shapley value of node j relative to node i. f( ) To counter the revision, Let be the specific perturbation term between node i and node j in the perturbation matrix. To combat the robust attention coefficient, softmax() This is the normalization function.

[0073] Based on further improvements to the above system, in the weighted summation module, the embedding vector of each node obtained by weighted summation is represented as follows:

[0074] ;

[0075] in, For iterative updates of node i and its neighboring nodes The embedding vector representation, Let M be the set of neighbors of node i; M be the total number of attention heads. This represents the weight matrix corresponding to the m-th attention head; The attention coefficient corresponding to the m-th attention head. This represents a vector concatenation operation. It is a non-linear activation function.

[0076] Based on further improvements to the above system, the access control module includes:

[0077] The rating prediction unit is used to predict the user node i to be analyzed and the target resource node j based on the embedding vector representations. and And the edge weight access strength from the user node i to the target resource node j. The predicted access control probability score for the user node i to the target resource node j is as follows:

[0078] ;

[0079] The probability calculation unit is used to obtain the probability that the user node i to be analyzed accesses the target resource node j as follows:

[0080] ;

[0081] in, It is a non-linear activation function. sigmoid() The activation function is sigmoid; the transformation matrix is... U and w Used for performing the corresponding matrix calculations. This represents a vector concatenation operation. b This represents the function bias term.

[0082] Based on further improvements to the above system, the system also includes:

[0083] The incremental update module is used to monitor and analyze user behavior in real time. It performs small-scale retraining only on the nodes affected by the user behavior and their corresponding local subgraphs to achieve incremental updates to the constructed graph model.

[0084] Compared with existing technologies, this invention proposes a power grid control data interface access control method and system based on graph neural networks. It constructs a graph model of users, interfaces, and data resource nodes, and encodes features using embedding or Z-score methods based on feature vectors with three different attributes: textual, numerical, and binary. These node features are then uniformly mapped to the same dimension and input into a graph attention network (GAT). The GAT incorporates a three-stage attention mechanism: pre-emptive defense (causal constraints), in-process resistance (adversarial disturbances), and post-event auditing (interpretability), enhancing the security of message passing and aggregation between nodes. This results in a more robust and interpretable node embedding representation. Subsequently, by concatenating node vectors and edge weights into a scoring function, multi-level access permissions are assigned based on the output probability score, achieving fine-grained access control. The system also supports real-time updates based on user behavior analysis, rapidly lowering access scores or restricting permissions for abnormal operations or high-risk behaviors, ensuring the dynamic nature and accuracy of the evaluation. This invention can effectively resist potential attacks, take into account the real-time and security requirements of power grid control scenarios, and significantly improve the access control efficiency of interfaces of critical power grid infrastructure.

[0085] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0086] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0087] Figure 1 This is a schematic flowchart of a power grid control data interface access control method based on graph neural networks in one embodiment of the present invention;

[0088] Figure 2 This is a detailed flowchart illustrating a preferred embodiment of the power grid control data interface access control method based on graph neural networks according to the present invention.

[0089] Figure 3 This is a schematic diagram of the decision-making process for permission allocation in a preferred embodiment of the present invention;

[0090] Figure 4 This is a schematic diagram showing the experimental results comparing the accuracy of recognition with that of a traditional GNN model in a preferred embodiment of the present invention. Detailed Implementation

[0091] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0092] Power grid control data mainly consists of information exchange between users and the control system. Due to the openness of the communication interface, this type of interactive data is highly susceptible to interference from abnormal behavior (such as misconfiguration, network attacks, or equipment failures). At the same time, since power grid control data interaction needs to be real-time and efficient, any delay or abnormal behavior may have a serious impact on the operation of the power system.

[0093] Because power grid control data interaction is characterized by strong real-time performance and complex structure, and abnormal behavior may exhibit non-static change patterns over time, traditional static models struggle to accurately capture the high dynamism and complex relationships of power grid control data.

[0094] In view of this, the present invention proposes a power grid regulation data interface access control method based on graph neural networks. Graph neural networks can perform deep learning on the complex relationships between nodes and edges, accurately characterize and capture the multidimensional relationships among users, interfaces and resources, and then integrate a three-stage attention mechanism and a real-time behavior update strategy to balance model accuracy and robustness, providing a more reliable security guarantee for power grid regulation.

[0095] like Figure 1 As shown, this embodiment of the invention provides a power grid control data interface access control method based on graph neural networks, the method comprising the following steps:

[0096] S11, construct a graph model of the power grid control data system using user nodes, data interface nodes and data resource nodes from historical data;

[0097] S12, input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to be analyzed to the target resource node;

[0098] S13, Based on the graph attention neural network, the attention coefficients are corrected in three stages: causal constraint, adversarial robustness and interpretability, to obtain the embedding vector representation of the user node to be analyzed and the target resource node;

[0099] S14, predict the access control probability score of the user node to be analyzed to the target resource node based on the embedded vector representation and the edge weight access strength, and grant the user to be analyzed corresponding operation permissions based on the probability score.

[0100] In this embodiment of the invention, the relationships between users, data interfaces, and data resources in the power grid control data system are captured and represented by a graph model. Specifically, the graph model of the power grid control data system is constructed using user nodes, data interface nodes, and data resource nodes from historical data. The edges of the graph model are established based on the situation where user nodes access data resource nodes through data interface nodes (each node is connected to the nodes related to its access permissions through edges, and users access data resources through data interfaces).

[0101] In this embodiment of the invention, the application of the graph neural network model is divided into two stages: offline training and online inference. During the training stage, a sample dataset is constructed using historical data (such as power grid access logs from the past six months). This dataset contains attribute information for user nodes, data interface nodes, and resource nodes, as well as corresponding access decision labels (label values ​​are 0 or 1, where 0 indicates denied access and 1 indicates allowed access). Labels are automatically generated based on preset security rules; for example, three consecutive failed access attempts or session anomalies are marked as 0. During training, a supervised learning approach is used, employing binary cross-entropy as the loss function to optimize the parameters of GAT and MLP. During the inference stage, the trained model is applied to process and predict real-time user access requests, outputting probability scores and assigning permissions.

[0102] In embodiments of the present invention, user nodes include two types of information: static attributes and dynamic behaviors. Static attributes include user role, permission level, and authentication status; dynamic behaviors include access frequency, abnormal operation records, and session activity. Data interface nodes include two types of information: static configuration and dynamic status. Static configuration includes interface type, protocol, and security level; dynamic status includes current load, health status, and risk flags. Resource nodes include information such as data type, access control level, and data sensitivity. In embodiments of the present invention, the embedding vector of the data interface node serves as a key intermediate variable in GAT message passing. User nodes and resource nodes perform feature aggregation through the interface node, so that the aggregated embedding vector implicitly contains interface layer security information.

[0103] Specifically, for different types of nodes, node-related information is categorized into text-based, numerical-based, and binary-based types. The feature vectors of each type are encoded and then concatenated to obtain the original embedding vectors for each node.

[0104] For textual information, a trainable embedding matrix is ​​used to encode the data; for numerical information, Z-score normalization is used; for binary information, feature concatenation can be performed directly, thus preserving the explicit indicative information of such attributes.

[0105] For example, attribute information such as user role, interface type, protocol, data type and access control level is textual information. In order to ensure the expressive power of the feature, 8-dimensional embedding is used to vector encode each textual information, that is, the textual information is embedded and encoded into an 8-dimensional feature through the corresponding embedding matrix.

[0106] The attribute information, including permission level, access frequency, and abnormal operation records, is numerical. To address the differences in the values, Z-score normalization is used to process each value into a numerical representation under a unified scale.

[0107] For more detailed information, types, and corresponding encoding methods, please see the table below:

[0108]

[0109] Using the above method, the dimensions of the original embedding vectors of various nodes obtained by splicing are as follows: 13-dimensional embedding vector for user nodes, 20-dimensional embedding vector for data interface nodes, and 17-dimensional embedding vector for data resource nodes.

[0110] Since different types of nodes have different vector dimensions, graph models cannot directly use data of multiple different dimensions. Therefore, this embodiment of the invention further uses a multilayer perceptron (MLP) to process each type of node separately, so as to map the embedding vectors of different types of nodes to the same dimension, so as to ensure that the graph model obtains node feature vectors with uniform dimensions.

[0111] Specifically, besides the input layer for receiving the input embedding vector data, the MLP also includes at least one hidden layer and an output layer. The hidden layer uses its activation function to represent the input data in a hidden manner, thereby learning complex relationships within the input data. The output layer then uses its activation function to parse / interpret the hidden representation into a prediction result, obtaining the output result data (in this embodiment, a uniform-dimensional output embedding vector). Preferably, in this embodiment, one MLP is used for each type of node. The MLP corresponding to each type of node processes the input node embedding vector separately, uniformly outputting a 12-dimensional output embedding vector. In this embodiment, the MLP is used to uniformly represent the node embedding vectors. The parameters in each MLP are not trained and optimized individually, but are jointly trained with the subsequent GAT.

[0112] Furthermore, in this embodiment of the invention, edges in the graph model are established based on user access data, and access strength is calculated as the edge weight. Specifically, based on historical data (e.g., power grid access logs from the past 6 months), the calculation of access strength includes at least historical access frequency, historical access success rate, and the degree of impact adjusted for time changes. Specifically, based on the historical data of user node i accessing resource node j, the weight of the edge from node i to node j is ultimately determined as follows:

[0113] ;

[0114] in, Historical access frequency, For time decay, For historical access success rate, , , Let be the weight coefficients for each item. In an embodiment of the present invention, for a new user node i or a new resource node j, if there is no access record of i to j in the historical data, a user node, interface node, and resource node are automatically added for the new access request, and an edge is established based on the access path; the edge weights are... The corresponding items are initialized to , , The changes will be adjusted subsequently through a real-time behavior update mechanism.

[0115] During access control, records with a closer time interval have a greater impact on edge weights, while the impact of older records gradually decreases over time, hence the term "time decay." This can be expressed using a formula:

[0116] ;

[0117] in, Indicates the current time. This represents the time of the k-th visit. This is a time decay factor used to control the impact of historical records. For time decay, This serves as a summation index for historical access records. In a preferred embodiment of the invention, the initial values ​​of each parameter can be set empirically, for example, α1=0.4, α2=0.3, α3=0.3, λ=0.1, and then optimized during model training.

[0118] Subsequently, in embodiments of the present invention, a graph attention neural network is used to realize message passing and aggregation between nodes based on the constructed graph model. In a preferred embodiment of the present invention, attention correction is performed in the GAT based on three attention mechanisms: causal constraint, adversarial robustness, and interpretability, respectively, in three stages: pre-emptive defense, in-process resistance, and post-event auditing. This enhances the security of node access, ultimately resulting in a more robust and interpretable node embedding representation.

[0119] Specifically, in the pre-emptive defense phase, causal constraint attention is used to avoid the influence of irrelevant access paths and filter non-causal access relationships. In a preferred embodiment of the invention, causal influence factors are generated based on interference analysis. Regenerate the time mask Limiting information propagation to calculate the final causal constraint attention:

[0120] ,

[0121] ,

[0122] ;

[0123] in, X j The input vector is obtained from the access events or features of node j; For external intervention At that time, the probability of the access decision for target node i is obtained based on historical intervention data; do( ) Operation refers to any human intervention that alters natural causality; The regular conditional probability of node i visiting node j is obtained statistically from historical observation data; As a causal influencing factor, For time mask, As before, this is the time decay factor. For the current moment, Let i be the time of the most recent interaction between node i and node j. To constrain attention to the ultimate causal relationship, The attention weights are calculated using the standard graph attention mechanism.

[0124] During the resistance phase, a gradient attack approach is used to simulate adversarial attack perturbations. By restricting attacker access paths through adversarial robust attention, and finally generating enhanced robust adversarial robust attention through adversarial correction terms:

[0125] ,

[0126] ;

[0127] in, The original adjacency matrix is ​​obtained from the constructed graph model; Here is the perturbation matrix. For the specific perturbation term between node i and node j, it is usually initialized starting from zero or a small random value and optimized during training using the projected gradient descent method; It is the disturbance intensity. To define the propagation function of a graph attention network, The supervisory signals, i.e. the labels required for training the graph model, such as the "normal / abnormal" labels in node classification, are mainly obtained from historical security event logs, the output of anomaly detection systems, or expert rule annotations. For the loss function, the cross-entropy loss function is preferably used in this embodiment of the invention;

[0128] In the formula, This represents a vector concatenation operation. To ultimately combat robust attention, the numerator part maps the feature vectors of nodes i and j through a weight matrix W (usually initialized using Xavier and subsequently optimized during GAT training), concatenates them, and then performs an inner product with the attention vector a (which can be randomly initialized and also optimized during GAT training), adding a perturbation correction term. ,through Attention scores are obtained through activation and exponential transformation; the denominator is calculated for all neighboring nodes of node i. k (including itself, i.e.) The same computation is performed on the set of neighbors (including the node itself), and the results are summed to complete the normalization.

[0129] final, The value of is between 0 and 1, and the sum of the coefficients of all neighboring nodes is 1. This relates to causal constraint attention. The result after combination is:

[0130] ;

[0131] in, f( ) To counteract the correction, multiplicative correction is preferred.

[0132] During the post-audit phase, the contribution of each node to the access control decision is calculated, a Shapley value is generated, and the final interpretability attention is calculated:

[0133] ,

[0134] ;

[0135] in, Let be the Shapley value of node j relative to node i, used to measure the marginal contribution of neighbor node j in the access decision; Let S be the set of neighbors of node i, containing all nodes directly connected to node i; let S be a subset of the neighbor set. For the cardinality of the subset, Size of the neighbor set; These are the weighting coefficients for the Shapley values; and These represent the access probabilities of node i when node j is added to or not added to the neighbor set, respectively. They can be estimated using the GAT model: that is, temporarily modify the neighbor set of node i to S or S∪j, recalculate the corresponding embedding vector, and input it into the scoring function to obtain the probability. This is the final interpretability attention. Based on this method, the marginal contribution of each neighbor node to the access decision is measured. In the subsequent audit process, if the interpretability attention of a certain edge is abnormally high, it will trigger a security review and source tracing analysis.

[0136] In embodiments of the present invention, message passing and aggregation between nodes are realized based on a standard graph attention neural network (GAT), and attention is corrected in three stages based on three attention mechanisms: causal constraint attention is obtained in the pre-defense stage, adversarial robustness is obtained in the in-process resistance stage, and interpretability attention is obtained in the post-audit stage.

[0137] Specifically, let Let represent the feature embedding vectors of nodes i and j respectively, the weight matrix W be a trainable linear transformation, and 'a' be a trainable attention vector. Then, the standard attention raw score between any node i and its neighbor j can be written as:

[0138] ,

[0139] Through Execute above (i.e., node j belongs to the neighbor set of node i, meaning node j is a neighbor node of node i) Obtain the initial standard attention coefficient Next, to achieve enhanced access control security, the following steps will be taken sequentially: The final attention coefficient is obtained by implementing the attention correction based on the three attention mechanisms in three stages. That is:

[0140]

[0141] .

[0142] Furthermore, in the Graph Attention Neural Network (GAT) of this invention, a multi-head attention mechanism is employed to enhance the model's expressive ability for complex access scenarios. For each node i, M parallel attention heads are defined, each attention head... All are based on the attention coefficients obtained by modifying the three attention mechanisms in the three stages mentioned above. For each neighboring node We perform a weighted summation of the feature embedding vectors and iteratively update the corrected embedding vectors of nodes i and j. :

[0143] ;

[0144] in, This represents the weight matrix corresponding to the m-th attention head (which is a trainable linear transformation matrix). The final attention coefficient is calculated independently by the m-th attention head (the calculation process is the same as described above); in the above formula, the embedding vector The correction processes influence each other, and the iterative update is manifested as nested calculation of data. Preferably, in this embodiment of the invention, the nesting is ended by a fixed number of calculations (i.e., only a limited number of nested calculations are performed).

[0145] Finally, in this embodiment of the invention, the embedded vector output by the graph model is combined with the edge weight access strength, and the probability of user i accessing resource j is predicted by the scoring function. Based on the probability, the user's final access permission is determined.

[0146] Specifically, in the access control process of this invention, access strength is calculated. As the edge weight between user node i and resource node j, this edge weight is concatenated with the node result embedding vector learned by GAT, and the final access control probability is predicted by the scoring function. For example, let... and Let i and j represent the GAT output representations of user node i and resource node j, respectively (i.e., the final embedding vectors after weighted summation and correction of the above formula). Given the access strength between the two, the scoring function and the corresponding probability are:

[0147] ,

[0148] ;

[0149] in, For non-linear activation functions, the transformation matrices U and w are used to perform corresponding matrix calculations (matrix superscript). T The transformation matrix (representing the transpose of a matrix) and both transformation matrices are trainable parameters that are optimized during model training. This represents a vector concatenation operation, where b represents the function bias term. This represents the predicted probability that user i will access resource j. Further threshold settings are then implemented. ,like If the condition is met, access is allowed; otherwise, it is denied. In a preferred embodiment of the invention, the access threshold is... It also supports dynamic adjustments, such as automatic adjustments based on real-time behavior monitoring: when the user's abnormal operation rate exceeds 5%, the system will automatically adjust... The limit can be reduced from 0.5 to 0.3; it can also be manually adjusted through the management interface, allowing modification of the permission range table, such as adjusting the denied access range to [0, 0.4), etc.

[0150] To facilitate a comprehensive understanding of the implementation of the technical solution of this invention, Figure 2 A preferred embodiment provides a detailed flowchart of a power grid regulation data interface access control method based on a graph neural network, implemented according to the ideas of this invention. It should be noted that... Figure 2 The preferred embodiments are only used to illustrate the relationship and function of each method step. As mentioned above, the application of graph neural network models can be divided into two stages: offline training and online inference. These two stages can be completed relatively independently. Figure 2 The text does not make a strict distinction between these two stages, therefore Figure 2 The preferred embodiments shown should not be considered as limitations on the specific implementation of the present invention.

[0151] Preferably, based on the predicted probability range, embodiments of the present invention can further subdivide into multiple permission levels to achieve more flexible and secure access control. For example, the predicted probabilities in embodiments of the present invention include... The threshold values ​​can be set according to the table below. Segmentation, when When a value falls within a different range, the system will grant the corresponding operation permissions:

[0152]

[0153] In a preferred embodiment of the present invention, to ensure that the judgment of user risk status can reflect their latest operational behavior in a timely manner, a real-time behavior monitoring and feature update mechanism is introduced for user nodes. This mechanism can adjust the feature embedding vector of user nodes in real time based on user behavior analysis. Preferably, the feature vector update of the user node adopts an exponential smoothing strategy, fusing the latest observation with existing node representations to reduce feature jitter caused by high-frequency behavior fluctuations. Furthermore, when a user is detected to have performed a high number of high-risk operations, an emergency update process is triggered to immediately adjust or isolate their access permissions. Preferably, the incremental or local update includes recalculating or performing small-scale retraining only on the affected user node and its neighboring subgraphs, without requiring a complete retraining of the entire graph.

[0154] Among them, such as Figure 3 As shown, the system deploys a user behavior monitoring module to continuously collect user behavior data (such as access logs, number of abnormal operations, session duration, and other dynamic indicators). If a user attempts to access highly sensitive resources multiple times in a short period of time, but all operations fail, the monitoring module will determine that this behavior indicator as an increased risk.

[0155] Based on the collected user behavior data, the system automatically calculates and updates the dynamic attributes corresponding to user nodes, including access frequency, abnormal operation records, and session activity. If the user's role or authentication status also changes, its static attributes are also modified simultaneously.

[0156] After the attribute values ​​are updated, numerical attributes are normalized using Z-score, while textual and binary attributes are processed through trainable embeddings or direct concatenation, ultimately forming the latest feature vector of the user node. In some implementations, to avoid fluctuations caused by high-frequency jitter, exponential smoothing can be used to fuse the old and new features, i.e.

[0157] ,

[0158] in For smoothing weights.

[0159] To ensure the real-time nature of user node features, this invention utilizes an incremental GAT update mechanism to perform small-scale retraining on affected nodes and their local subgraphs, thereby enhancing the embedding representation of user node u in the graph model. Maintain consistency with the current behavior. In sensitive scenarios, such as detecting that the number of abnormal user operations exceeds a threshold, the system can trigger an emergency update and temporarily reduce the access weight or available permissions of that user node.

[0160] In one embodiment of the present invention, to verify the beneficial effects of the invention, scientific demonstration was conducted through simulation and comparative experiments. Specifically, a power grid data access interface has 20 access records in the current period, covering elements such as user nodes, interface nodes, and resource nodes. Each record includes attributes such as access permission level, user role, and data sensitivity. See the table below for details:

[0161]

[0162] Simulation and Comparison Experiment Environment: PyCharm 2024.2.1 was run on a Windows 10 system, using Python 3.10 as the programming language and PyTorch as the deep learning framework. This experiment compares the simulation with a traditional GNN model, employing unified training and test datasets, with accuracy as the core evaluation metric. Specific results are as follows: Figure 4 As shown.

[0163] On the other hand, embodiments of the present invention provide a power grid control data interface access control system based on graph neural networks, the system comprising:

[0164] The graph model building module is used to build a graph model of the power grid control data system using user nodes, data interface nodes and data resource nodes from historical data.

[0165] The access strength calculation module is used to input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to be analyzed to the target resource node.

[0166] The attention correction module is used to perform three-stage correction of the attention coefficients based on graph attention neural network, namely causal constraint, adversarial robustness and interpretability, to obtain the embedding vector representation of the user node to be analyzed and the target resource node.

[0167] The access control module is used to predict the access control probability score of the user node to be analyzed to the target resource node based on the embedded vector representation and the edge weight access strength, and to grant the user to be analyzed corresponding operation permissions based on the probability score.

[0168] Based on further improvements to the above system, the access strength calculation module includes:

[0169] The strength calculation subunit is used to calculate the edge weight access strength based on the historical data of the user node i to be analyzed accessing the target resource node j:

[0170] ;

[0171] in, , , These are the weight coefficients for each item; Historical access frequency, For historical access success rate, For time decay, there is ; Indicates the current time. This represents the time of the k-th visit. This is the time decay factor.

[0172] Based on further improvements to the above system, the attention correction module includes:

[0173] The standard attention coefficient calculation unit is used to obtain the initial standard attention coefficient based on the original standard attention scores of any node and its neighbors in the graph model.

[0174] The causal correction unit is used to correct the standard attention coefficients to obtain causal constraint attention coefficients by applying causal influence factors and time mask constraints during the ex-ante defense phase.

[0175] The combined correction unit is used to generate adversarial robust attention coefficients through adversarial correction terms during the in-process resistance phase, and to combine the adversarial robust attention coefficients with the causal constraint attention coefficients to obtain the combined attention coefficients.

[0176] An interpretability correction unit is used to correct the combined attention coefficients during the post-audit phase by assessing each node's contribution to the access permission decision, thereby obtaining interpretable attention coefficients.

[0177] Based on further improvements to the above system, the system also includes:

[0178] A multi-head attention module is used to employ a multi-head attention mechanism in the graph attention neural network. Multiple parallel attention heads are defined for each node, and each attention head performs the three-stage correction to obtain its own attention coefficient.

[0179] The weighted summation module is used to perform weighted summation on the feature vectors of neighboring nodes using the attention coefficients of each attention head to obtain the embedding vector representation of each node.

[0180] Based on further improvements to the above system, the attribute information of the user node includes user role, permission level, authentication status, access frequency, abnormal operation records, and session activity; the attribute information of the data interface node includes interface type, protocol, security level, current load, health status, and risk marker; the attribute information of the resource node includes data type, access control level, and data sensitivity; the system also includes:

[0181] The encoding module is used to classify the attribute information of each node into text, numeric and binary types, perform corresponding encoding processing on each type, and then concatenate the encoded attribute information to obtain the original embedding vector of each node.

[0182] Based on further improvements to the above system, the encoding processing module includes:

[0183] The text encoding unit is used to encode attribute information using a trainable embedding matrix for textual information.

[0184] Numerical encoding unit, used for Z-score normalization processing of numerical information;

[0185] The binary processing unit is used to directly perform feature concatenation on binary information.

[0186] Based on further improvements to the above system, the system also includes:

[0187] The vector alignment module is used to map the original embedding vectors of different types of nodes to the same dimension through a multilayer perceptron, so as to obtain the output embedding vectors of each node.

[0188] Based on further improvements to the above system, the interpretability attention coefficient is expressed as:

[0189] ;

[0190] in, Let the initial standard attention coefficients be obtained based on any node i and its neighboring nodes j. These are causal influence factors generated based on interference analysis. For time mask, Let be the Shapley value of node j relative to node i. f( ) To counter the revision, Let be the specific perturbation term between node i and node j in the perturbation matrix. To combat the robust attention coefficient, softmax() This is the normalization function.

[0191] Based on further improvements to the above system, in the weighted summation module, the embedding vector of each node obtained by weighted summation is represented as follows:

[0192] ;

[0193] in, For iterative updates of node i and its neighboring nodes The embedding vector representation; M is the total number of attention heads. This represents the weight matrix corresponding to the m-th attention head; The attention coefficient corresponding to the m-th attention head. This represents a vector concatenation operation. It is a non-linear activation function.

[0194] Based on further improvements to the above system, the access control module includes:

[0195] The rating prediction unit is used to predict the user node i to be analyzed and the target resource node j based on the embedding vector representations. and And the edge weight access strength from the user node i to the target resource node j. The predicted access control probability score for the user node i to the target resource node j is as follows:

[0196] ;

[0197] The probability calculation unit is used to obtain the probability that the user node i to be analyzed accesses the target resource node j as follows:

[0198] ;

[0199] in, The activation function is nonlinear; the transformation matrix is... U and w Used for performing the corresponding matrix calculations. This represents a vector concatenation operation. b This represents the function bias term.

[0200] Based on further improvements to the above system, the system also includes:

[0201] The incremental update module is used to monitor and analyze user behavior in real time. It performs small-scale retraining only on the nodes affected by the user behavior and their corresponding local subgraphs to achieve incremental updates to the constructed graph model.

[0202] Compared with existing technologies, this invention proposes a power grid control data interface access control method and system based on graph neural networks. It constructs a graph model of users, interfaces, and data resource nodes, and encodes features using embedding or Z-score methods based on feature vectors with three different attributes: textual, numerical, and binary. These node features are then uniformly mapped to the same dimension and input into a graph attention network (GAT). The GAT incorporates a three-stage attention mechanism: pre-emptive defense (causal constraints), in-process resistance (adversarial disturbances), and post-event auditing (interpretability), enhancing the security of message passing and aggregation between nodes. This results in a more robust and interpretable node embedding representation. Subsequently, by concatenating node vectors and edge weights into a scoring function, multi-level access permissions are assigned based on the output probability score, achieving fine-grained access control. The system also supports real-time updates based on user behavior analysis, rapidly lowering access scores or restricting permissions for abnormal operations or high-risk behaviors, ensuring the dynamic nature and accuracy of the evaluation. This invention can effectively resist potential attacks, take into account the real-time and security requirements of power grid control scenarios, and significantly improve the access control efficiency of interfaces of critical power grid infrastructure.

[0203] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0204] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A power grid control data interface access control method based on graph neural networks, characterized in that, The method includes the following steps: A graph model of the power grid control data system is constructed using user nodes, data interface nodes, and data resource nodes from historical data. Input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to the target resource node. Based on the graph attention neural network, the attention coefficients are corrected in three stages: causal constraint, adversarial robustness, and interpretability, to obtain the embedding vector representations of the user node to be analyzed and the target resource node; wherein, the graph attention neural network adopts a multi-head attention mechanism; Based on the embedded vector representation and the edge weight access strength, predict the access control probability score of the user node to be analyzed for the target resource node, and grant the user to be analyzed corresponding operation permissions based on the probability score; The edge weight access strength from the user node to the target resource node is obtained as follows: Based on the historical data of the user node i accessing the target resource node j, the edge weight access strength is calculated as follows: ； in, , , These are the weight coefficients for each item; Historical access frequency, For historical access success rate, For time decay, there is ; Indicates the current time. This represents the time of the k-th visit. This is the time decay factor; Based on a graph attention neural network, the attention coefficients are corrected in three stages: causal constraint, adversarial robustness, and interpretability, to obtain the embedding vector representations of the user node to be analyzed and the target resource node, including: For each node, multiple parallel attention heads are defined, and each attention head undergoes the three-stage correction of causal constraints, adversarial robustness, and interpretability to obtain its own attention coefficient; The embedding vector representation of each node is obtained by weighted summing of the feature vectors of the neighboring nodes using the attention coefficients of each attention head. The three-stage modification of causal constraints, adversarial robustness, and interpretability includes: The initial standard attention coefficients are obtained based on the original standard attention scores of any node and its neighboring nodes in the graph model. In the pre-defense phase, the causal constraint attention coefficient is obtained by applying a causal influence factor and a time mask constraint to the standard attention coefficient; During the resistance phase, adversarial robust attention coefficients are generated through adversarial correction terms, and combined with the adversarial robust attention coefficients and the causal constraint attention coefficients to obtain the combined attention coefficients. During the post-audit phase, the combined attention coefficient is adjusted based on each node's contribution to the access permission decision to obtain the interpretable attention coefficient.

2. The method according to claim 1, characterized in that, The attribute information of the user node includes user role, permission level, authentication status, access frequency, abnormal operation records, and session activity; the attribute information of the data interface node includes interface type, protocol, security level, current load, health status, and risk flag; the attribute information of the resource node includes data type, access control level, and data sensitivity; the method further includes the following steps: The attribute information of each node is divided into text, numerical and binary types, and corresponding encoding processes are performed. The encoded attribute information is then concatenated to obtain the original embedding vector of each node.

3. The method according to claim 1, characterized in that, The interpretability attention coefficient is expressed as: ； in, Let the initial standard attention coefficients be obtained based on any node i and its neighboring nodes j. These are causal influence factors generated based on interference analysis. For time mask, Let be the Shapley value of node j relative to node i. f( ) To counter the revision, Let be the specific perturbation term between node i and node j in the perturbation matrix. To combat the robust attention coefficient, softmax() This is the normalization function.

4. The method according to claim 1, characterized in that, The embedding vectors of each node obtained by weighted summation are represented as follows: ； in, For iterative updates of node i and its neighboring nodes The embedding vector representation, Let M be the set of neighbors of node i; M be the total number of attention heads. This represents the weight matrix corresponding to the m-th attention head; The attention coefficient corresponding to the m-th attention head. This represents a vector concatenation operation. It is a non-linear activation function.

5. The method according to claim 4, characterized in that, The step of predicting the access control probability score of the user node to be analyzed for the target resource node based on the embedded vector representation and the edge weight access strength includes: make and Let i and j represent the embedding vector representations of the user node i to be analyzed and the target resource node j, respectively. Given the edge weight access strength from the user node i to the target resource node j, the predicted access control probability score for the user node i to the target resource node j is as follows: ； The probability that the user node i to be analyzed accesses the target resource node j is: ； Wherein, the transformation matrix U and w Used for performing the corresponding matrix calculations. b This represents the function bias term. sigmoid() It is a sigmoid activation function.

6. The method according to claim 1, characterized in that, The method further includes the following steps: Real-time monitoring and analysis of user behavior, and small-scale retraining only on nodes affected by the user behavior and their corresponding local subgraphs, to achieve incremental updates to the constructed graph model.

7. A power grid control data interface access control system based on graph neural networks, characterized in that, The system includes: The graph model building module is used to build a graph model of the power grid control data system using user nodes, data interface nodes and data resource nodes from historical data. The access strength calculation module is used to input the user node to be analyzed into the constructed graph model to obtain the edge weight access strength from the user node to the target resource node; wherein, obtaining the edge weight access strength from the user node to the target resource node includes: Based on the historical data of the user node i accessing the target resource node j, the edge weight access strength is calculated as follows: ； in, , , These are the weight coefficients for each item; Historical access frequency, For historical access success rate, For time decay, there is ; Indicates the current time. This represents the time of the k-th visit. This is the time decay factor; The attention correction module is used to perform three-stage correction of the attention coefficients based on the graph attention neural network, namely, causal constraint, adversarial robustness and interpretability, to obtain the embedding vector representation of the user node to be analyzed and the target resource node; wherein, the graph attention neural network adopts a multi-head attention mechanism; Based on a graph attention neural network, the attention coefficients are corrected in three stages: causal constraint, adversarial robustness, and interpretability, to obtain the embedding vector representations of the user node to be analyzed and the target resource node, including: For each node, multiple parallel attention heads are defined, and each attention head undergoes the three-stage correction of causal constraints, adversarial robustness, and interpretability to obtain its own attention coefficient; The embedding vector representation of each node is obtained by weighted summing of the feature vectors of the neighboring nodes using the attention coefficients of each attention head. The three-stage modification of causal constraints, adversarial robustness, and interpretability includes: The initial standard attention coefficients are obtained based on the original standard attention scores of any node and its neighboring nodes in the graph model. In the pre-defense phase, the causal constraint attention coefficient is obtained by applying a causal influence factor and a time mask constraint to the standard attention coefficient; During the resistance phase, adversarial robust attention coefficients are generated through adversarial correction terms, and combined with the adversarial robust attention coefficients and the causal constraint attention coefficients to obtain the combined attention coefficients. In the post-audit phase, the combined attention coefficient is adjusted by the contribution of each node to the access permission decision to obtain the interpretability attention coefficient; The access control module is used to predict the access control probability score of the user node to be analyzed to the target resource node based on the embedded vector representation and the edge weight access strength, and to grant the user to be analyzed corresponding operation permissions based on the probability score.

Images