Substation secondary system network intrusion detection method, device and system

Abstract

The present application relates to a method, device and system for detecting network intrusion in a secondary system of a substation. The method for detecting network intrusion in a secondary system of a substation comprises: obtaining data to be detected; processing the data to be detected using an intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the intrusion detection model is obtained by extracting an effective feature subset from an intrusion detection data set of the secondary system of the substation, and inputting the effective feature subset into a variational autoencoder based on a self-attention mechanism for training; judging whether the reconstruction probability exceeds a threshold, and confirming whether the data to be detected is intrusion data based on the judgment result. The present application is used to solve the problem of insufficient accuracy of the current intrusion detection algorithm based on deep learning when detecting unknown attacks, can effectively detect abnormal network traffic, and can effectively improve the detection performance of unknown network attacks, as well as improve the detection rate of network attacks, and enhance the security of the secondary system of the substation.

Description

Technical Field

[0001] The present application relates to the technical field of network intrusion detection, and in particular to a method, device and system for detecting network intrusion in a secondary system of a substation. Background Art

[0002] With the access of a large number of smart substation secondary system equipment, network operation data will tend to be more massive, heterogeneous and low-quality. The secondary system of the smart substation faces the security threat of network intrusion, and its intrinsic safety is seriously affected. How to prevent the secondary system of the smart substation from being attacked by network and improve the intrinsic safety factor of the secondary system of the smart substation is an urgent problem to be solved in the field of intrinsic safety of the secondary system of the smart substation. The intrusion detection method of the secondary system of the smart substation is the main preventive measure to prevent the secondary system from being attacked by network. With the rapid progress of deep learning technology in many industries, deep learning models have been widely used in the field of intrusion detection, providing a new direction for the field of intrusion detection. The deep learning method integrates advanced feature extraction and classification tasks, overcomes some limitations of shallow learning, and effectively promotes the development of intrusion detection methods.

[0003] Intrusion detection methods based on deep learning have achieved good detection results to a certain extent, but they still face many problems and challenges. First, in the actual network environment of the secondary system of smart substations, different types of network traffic are unbalanced, and network intrusion records are less than normal records. The classifier is biased towards records that appear more frequently, which reduces the detection rate of a few attacks. Secondly, due to the large network traffic and complex structure, traditional classifier algorithms are difficult to achieve a high detection rate. Third, various new attacks are appearing frequently. Since many unknown attacks do not appear in the training data set, existing intrusion detection methods usually perform poorly in detecting unknown attacks.

[0004] During the implementation process, the inventors found that there are at least the following problems in the traditional technology: the current substation secondary system network intrusion detection method has a low detection rate for network attacks. Summary of the invention

[0005] Based on this, it is necessary to provide a substation secondary system network intrusion detection method, device and system to address the above technical problems.

[0006] A substation secondary system network intrusion detection method, comprising:

[0007] Obtain the data to be tested;

[0008] The intrusion detection model is used to process the data to be detected to obtain a processing result; the processing result includes the reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from the intrusion detection data set of the substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training;

[0009] Determine whether the reconstruction probability exceeds a threshold, and confirm whether the data to be detected is intrusion data based on the judgment result.

[0010] In one embodiment, the step of extracting a valid feature subset from an intrusion detection data set of a substation secondary system includes:

[0011] Acquire an intrusion detection data set, and normalize each feature in the intrusion detection data set to obtain each normalized feature;

[0012] Calculate the mutual information values ​​of each normalized feature respectively;

[0013] According to each mutual information value, an effective feature subset is extracted from the intrusion detection dataset.

[0014] In one embodiment, the step of inputting a valid feature subset into a variational autoencoder based on a self-attention mechanism for training includes:

[0015] A variational autoencoder is used to encode each feature of the effective feature subset to generate multiple intermediate latent variables;

[0016] The final latent variable is obtained by extending the self-attention mechanism to the intermediate latent variables;

[0017] The decoder is used to decode the final latent variable to obtain the reconstructed data.

[0018] In one embodiment, the step of obtaining the final latent variable by extending the self-attention mechanism to the intermediate latent variable includes:

[0019] Calculate the cosine similarity between the query vector and each intermediate latent variable;

[0020] Convert the similarity scores of each cosine similarity into each alignment weight coefficient;

[0021] The final latent variable is obtained by weighted summing up the alignment weight coefficients.

[0022] In one embodiment, the step of inputting the effective feature subset into a variational autoencoder based on a self-attention mechanism for training further includes:

[0023] The objective function is constructed through classification latent variables, posterior probability, prior probability, likelihood probability and final latent variables.

[0024] In one embodiment, the step of inputting the effective feature subset into a variational autoencoder based on a self-attention mechanism for training further includes:

[0025] The reconstruction probability is obtained by sampling the prior probability several times and averaging the reconstruction error.

[0026] In one embodiment, the step of determining whether the reconstruction probability exceeds a threshold and determining whether the data to be detected is intrusion data according to the determination result includes:

[0027] If the judgment result is that the reconstruction probability exceeds the threshold, the data to be detected is confirmed to be intrusion data;

[0028] If the judgment result is that the reconstruction probability does not exceed the threshold, the data to be detected is confirmed to be normal data.

[0029] A substation secondary system network intrusion detection device, comprising:

[0030] A data acquisition module, used for acquiring data to be detected;

[0031] The data processing module is used to process the data to be detected using the intrusion detection model to obtain a processing result; the processing result includes the reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from the intrusion detection data set of the substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training;

[0032] The judgment module is used to judge whether the reconstruction probability exceeds a threshold, and confirm whether the data to be detected is intrusion data according to the judgment result.

[0033] A substation secondary system network intrusion detection system, comprising: an edge computing device and a substation secondary system; the edge computing device and the substation secondary system are communicatively connected;

[0034] The substation secondary system outputs intrusion detection data to the edge computing device;

[0035] The edge computing device receives the intrusion detection data and adds the intrusion detection data to the intrusion detection data set. The edge computing device extracts the effective feature subset from the intrusion detection data set and inputs the effective feature subset into the variational autoencoder based on the self-attention mechanism for training to obtain the intrusion detection model. The edge computing device sends the intrusion detection model to the substation secondary system.

[0036] The substation secondary system receives the intrusion detection model, and processes the data to be detected based on the intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the substation secondary system determines whether the reconstruction probability exceeds a threshold, and confirms whether the data to be detected is intrusion data based on the judgment result.

[0037] A computer-readable storage medium stores a computer program, which implements the steps of the above method when executed by a processor.

[0038] One of the above technical solutions has at least the following advantages and beneficial effects:

[0039] The present application obtains the data to be detected and processes the data to be detected using an intrusion detection model to obtain a reconstruction probability (RP), and determines whether the reconstruction probability exceeds a threshold value to confirm whether the data to be detected is intrusion data, wherein the intrusion detection model is obtained by extracting an effective feature subset from an intrusion detection data set of a substation secondary system, and inputting the effective feature subset into a variational auto-encoder (VAE) based on a self-attention mechanism for training. The present application is used to solve the problem of insufficient accuracy of the current intrusion detection algorithm based on deep learning when detecting unknown attacks, and can explicitly explore the potential changes and diversity implied in the training samples. By using the reconstruction probability as an abnormal score, it is more principled and objective than the reconstruction error, and can effectively detect abnormal network traffic. In addition, the intrusion detection model of the present application introduces the self-attention mechanism into the variational auto-encoder, which can effectively improve the detection performance of unknown network attacks, as well as improve the detection rate of network attacks, and enhance the intrinsic safety of the substation secondary system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the conventional technology, the drawings required for use in the embodiments or the conventional technology descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A schematic diagram of a flow chart of a substation secondary system network intrusion detection method in one embodiment;

[0042] Figure 2 A flowchart of the steps of extracting a valid feature subset from an intrusion detection data set of a substation secondary system in one embodiment;

[0043] Figure 3A flowchart of the steps of inputting a valid feature subset into a variational autoencoder based on a self-attention mechanism for training in one embodiment;

[0044] Figure 4 A schematic flow chart of the steps of obtaining the final latent variables in one embodiment;

[0045] Figure 5 It is a structural block diagram of a substation secondary system network intrusion detection device in one embodiment;

[0046] Figure 6 A schematic diagram of the structure of a network intrusion detection system for a secondary system of a substation in an embodiment;

[0047] Figure 7 This is a flowchart of a substation secondary system network intrusion detection system processing detection data in an example. DETAILED DESCRIPTION

[0048] In order to facilitate understanding of the present application, the present application will be described more fully below with reference to the relevant drawings. Embodiments of the present application are provided in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0049] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0050] It should be noted that when an element is considered to be "connected" to another element, it can be directly connected to the other element, or connected to the other element through an intermediate element. In addition, the "connection" in the following embodiments should be understood as "electrical connection", "communication connection", etc. if there is transmission of electrical signals or data between the connected objects.

[0051] When used herein, the singular forms "a", "an", and "said / the" may also include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include / comprise" or "have" etc. specify the presence of stated features, wholes, steps, operations, components, parts or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof.

[0052] In one embodiment, Figure 1 As shown, a substation secondary system network intrusion detection method is provided, comprising:

[0053] Step 202, obtaining the data to be detected;

[0054] Step 204, using the intrusion detection model to process the data to be detected to obtain a processing result; the processing result includes the reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from the intrusion detection data set of the substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training;

[0055] Step 206 , determining whether the reconstruction probability exceeds a threshold, and determining whether the data to be detected is intrusion data based on the determination result.

[0056] Among them, in order to prevent the secondary system of the substation from the security risk of network intrusion, it is necessary to detect the network operation data used by the secondary system of the substation, that is, the network operation data used by the secondary system of the substation is used as the data to be detected, and the data to be detected may contain intrusion data, abnormal data and other data that endanger the security of the secondary system of the substation. Reconstruction probability is a probability measurement that considers the variability of variable distribution. The intrusion detection dataset contains feature samples with training value, and the features are tags used to identify network data. The attention mechanism imitates the internal process of biological observation behavior, that is, a mechanism that aligns internal experience and external sensation to increase the observation precision of some areas. The attention mechanism can quickly extract important features of sparse data, so it is widely used in natural language processing tasks, especially machine translation. The self-attention mechanism is an improvement of the attention mechanism, which reduces the dependence on external information and is better at capturing the internal correlation of data or features. Variational autoencoders are an important type of generative model that can be used to model prior data distributions. They consist of two parts: an encoder and a decoder. The encoder maps high-level features of the data distribution to a low-level representation of the data, called a latent vector. The decoder absorbs the low-level representation of the data and then outputs a high-level representation of the same data.

[0057] Specifically, the intrusion detection model is used to process the acquired data to be detected to obtain a processing result, so as to judge whether the data to be detected is intrusion data according to the reconstruction probability in the processing result; wherein, the intrusion detection model is obtained by extracting a valid feature subset from the intrusion detection data set of the substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training, that is, the present application uses the trained variational autoencoder as an intrusion detection model to detect the data to be detected, and judges the abnormal situation of the data to be detected by taking the corresponding reconstruction probability obtained as an abnormality score, and confirms whether the reconstruction probability exceeds a threshold value according to the judgment result whether the data to be detected is intrusion data, that is, judges whether the data to be detected is abnormal, thereby preventing abnormal network data from invading the substation secondary system and causing harm to the operation of the substation secondary system.

[0058] The present application processes the data to be detected by using an intrusion detection module, thereby confirming whether the data to be detected is intrusion data based on the reconstruction probability in the processing result, wherein the intrusion detection model is obtained by inputting the effective feature subset extracted from the intrusion detection data set of the substation secondary system into the variational autoencoder based on the self-attention mechanism for training. The present application can explicitly explore the potential changes and diversity implied in the training samples (intrusion detection data), and by using the reconstruction probability as the abnormal score, it is more principled and objective than the reconstruction error used in the traditional detection method, and can perform more effective detection of abnormal network traffic. In addition, the intrusion detection model of the present application introduces the self-attention mechanism into the variational autoencoder VAE, thereby effectively improving the detection performance of the model for unknown attacks, improving the accuracy of detecting network attacks, and enhancing the inherent safety of the secondary system of the smart substation.

[0059] In one embodiment, if Figure 2 As shown, step 204 of extracting a valid feature subset from the intrusion detection data set of the substation secondary system may include:

[0060] Step 302, obtaining an intrusion detection data set, and normalizing each feature in the intrusion detection data set to obtain each normalized feature;

[0061] Step 304, respectively calculating each mutual information value of each normalized feature;

[0062] Step 306: extracting a valid feature subset from the intrusion detection data set according to each mutual information value.

[0063] Among them, mutual information is a useful information measure in information theory. It can be regarded as the amount of information contained in a random variable about another random variable, or the uncertainty of a random variable reduced by knowing another random variable. Mutual information is a measure of the degree of mutual dependence between random variables.

[0064] Specifically, if the original data in the intrusion detection dataset is directly input into the variational autoencoder VAE model, the convergence speed of the model will be reduced, or even the convergence will be destroyed, that is, the model still cannot converge after a large number of iterations. Therefore, before using the dataset, the data of different dimensions and properties are converted to 0~1 by normalization. The conversion formula is as follows:

[0065]

[0066] In this conversion formula, y is any value in a dimension in the data, max is the maximum value in the dimension, and min is the minimum value in the dimension.

[0067] In many intrusion detection data sets, only a few features contain information about the attack, while other features are common properties of the network and have nothing to do with whether an intrusion occurs, and are redundant information. Using a large number of features to train an intrusion detection model will increase the training time and easily cause the model to overfit, resulting in a decrease in generalization ability. Therefore, this application adopts a feature extraction method based on mutual information to identify and select effective feature subsets from the intrusion detection data set for model training.

[0068] The mutual information method is a typical filtering method used to measure the degree to which a feature distinguishes classes in a data set. The mutual information value is usually calculated using the concept of information entropy, which is a measure of the uncertainty of a random variable. Let the input be X and the output be Y, and then sort the intrusion detection data set in ascending order according to the output. We get:

[0069] (1) Set Y={Y1,Y2,…,Y Ny The initial entropy of the class in} is expressed as:

[0070]

[0071] Where N y Represents the number of possible output values ​​Y; P(Y j ) are the probabilities of different outputs.

[0072] (2) Conditional entropy H(Y|X) describes the relationship between a specific class and its input features, expressed as:

[0073]

[0074] Where N x is the number of possible input values ​​X; P(Y j |X i ) indicates that the input value is X i The output is Y under the condition j The probability of P(X i ) represents the probability of different values ​​in the input feature.

[0075] (3) Finally, the mutual information of each feature relative to the output is as follows:

[0076] I(Y;X)=H(Y)-H(Y|X)

[0077] Where I(Y; X) represents the mutual information between two random variables X and Y, which can reduce the uncertainty of X when the probability of Y is known.

[0078] Based on the above process, the mutual information value of each feature can be calculated.

[0079] By normalizing the features in the intrusion detection data set to avoid affecting the convergence speed of the intrusion detection model training process, the normalized features are obtained; then the mutual information value of each normalized feature in the intrusion detection data is calculated respectively, so as to extract an effective feature subset from the intrusion detection data set according to the mutual information value of each normalized feature, that is, select the features with attack information and input them into the variational autoencoder for targeted training.

[0080] This application uses a normalization method and a feature extraction method of mutual information to preprocess and extract features from intrusion selection data, and then inputs the valid feature data into a variational autoencoder based on an attention mechanism for model training. Compared with directly using all the features in the data, the mutual information value is used to obtain effective features, which can reduce the data dimension while making the model have higher generalization performance.

[0081] In one embodiment, if Figure 3 As shown, step 204 of inputting the effective feature subset into the variational autoencoder based on the self-attention mechanism for training may include:

[0082] Step 402, using a variational autoencoder to encode each feature of the valid feature subset to generate multiple intermediate latent variables;

[0083] Step 404, obtaining a final latent variable by extending the self-attention mechanism to an intermediate latent variable;

[0084] Step 406: Use a decoder to decode the final latent variable to obtain reconstructed data.

[0085] Specifically, since VAE is an unsupervised model, it can only generate output numbers similar to the input, which is not enough to fully grasp the instinctive characteristics of the input data, and does not pay attention to the relationship between potential quantities during the encoding process. In order to overcome the above shortcomings and limitations, the present application optimizes VAE based on the self-attention mechanism. The optimization process is as follows: first, a variational autoencoder is used to encode each feature of the effective feature subset, and multiple intermediate latent variables are generated during the encoding process; then, by introducing the self-attention mechanism, the intermediate latent variables are weighted and summed, and the self-attention mechanism is extended to the intermediate latent variables, thereby obtaining the final latent variables; finally, the final latent variables are decoded to obtain reconstructed data. The present application optimizes the variational autoencoder based on the self-attention mechanism to improve the detection rate by extracting and integrating the rich feature information of the original sample.

[0086] This application introduces the self-attention mechanism into the variational autoencoder, collects implicit feature information in the training samples (valid feature subsets), and integrates it into the final latent variables, thereby effectively improving the detection performance of the intrusion detection model for unknown attacks and enhancing the inherent safety of the secondary system of the smart substation.

[0087] In one embodiment, if Figure 4 As shown, step 404 of obtaining the final latent variable by extending the self-attention mechanism to the intermediate latent variable may include:

[0088] Step 502, calculating the cosine similarities between the query vector and each intermediate latent variable;

[0089] Step 504, converting the similarity scores of the cosine similarities into alignment weight coefficients respectively;

[0090] Step 506 , obtaining a final latent variable by performing weighted summation on each alignment weight coefficient.

[0091] Specifically, for the inference process of intermediate latent variables, the variational autoencoder VAE generates multiple intermediate latent variables

[0092]

[0093] In the formula, the intermediate latent variable It consists of key and value data pairs, and c represents the classification latent variable. Assuming that the query in the self-attention mechanism follows a standard Gaussian distribution, the final latent variable is generated by extending the self-attention mechanism to the intermediate latent variable. The specific process is as follows:

[0094] (1) The query vector q c and each key vector Considered as concatenated vectors, they are respectively composed of the mean vector μ satisfying the Gaussian distribution and the covariance matrix The query vector q is calculated by the following formula: c and key vector The cosine similarity S j :

[0095]

[0096] In the formula, j=1,2,…,m.

[0097] (2) Introduce a calculation method similar to SoftMax to convert the similarity score of the previous stage into an alignment weight

[0098]

[0099] (3) In obtaining The corresponding alignment weight coefficient Afterwards, the final latent continuous variable z is obtained by weighted summation:

[0100]

[0101] This application calculates the cosine similarities of the query vector and each of the intermediate latent variables, and converts the similarity scores of each of the cosine similarities into alignment weight coefficients, and then obtains the final latent variable by weighted summation of the alignment weight coefficients. Thus, this application introduces the self-attention mechanism into the variational autoencoder, obtains the dynamic weight of each variable, and then integrates the change factors contained in the training samples of the intrusion detection data set into the final latent variable, thereby effectively improving the detection performance of the intrusion detection model for unknown attacks, improving the detection accuracy, and enhancing the intrinsic safety of the secondary system of the smart substation.

[0102] In one embodiment, step 204 of inputting the effective feature subset into the variational autoencoder based on the self-attention mechanism for training may also include:

[0103] The objective function is constructed through classification latent variables, posterior probability, prior probability, likelihood probability and final latent variables.

[0104] Specifically, when the encoder generates the final latent variable z and the classification latent variable c from the sample data x, the posterior probability q φ (z,c|x), prior probability p(z,c) and likelihood probability p θ (x|z,c), the objective function is constructed as:

[0105]

[0106] The encoder of the present application generates the final latent variable z and the categorical latent variable c from the sample data x respectively; then, the decoder reconstructs the final latent variable z and the categorical latent variable c to obtain the output result. Assume that the continuous and discrete latent variables are conditionally independent, that is, q φ (z,c|x)=q φ (z|x)×q φ (c|x). The same is true for the prior probability, p(z,c) = p(z) × p(c), so the performance of the VAE model can be improved by increasing the information capacity during training:

[0107]

[0108] Where D z and D c denote the capacity of the controlled information of the continuous channel and the discrete channel, respectively, and their values ​​gradually increase during the training process. β is a constant that can match D by constraining the Kullback-Leibler divergence term. z and D c .

[0109] In one embodiment, step 204 of inputting the effective feature subset into the variational autoencoder based on the self-attention mechanism for training may also include:

[0110] The reconstruction probability is obtained by sampling the prior probability several times and averaging the reconstruction error.

[0111] Specifically, given the test data x, the encoder takes the parameter estimates of the latent Gaussian variables μ and σ as output, and then distributes them according to the distribution N(μ,σ) of the latent variables. 2 ), and the final latent variable z is sampled L times using reparameterization:

[0112] z l =μ+σ·ξ l

[0113] In the formula, ξ~N(0,I), l=1,2,…,L. Therefore, the reconstruction probability can be obtained by VAE according to the prior probability p θ (z) The average reconstruction error of sampling L times is calculated as shown in the following formula:

[0114]

[0115] The present application calculates RP using random latent variables that generate the distribution parameters of the original input variables, which is fundamentally equivalent to the probability of generating data from certain latent variables taken from the approximate posterior distribution. RP not only considers the difference between the original input and the reconstruction, but also considers the variability of the reconstruction by considering the variance parameter, and by using this function, the selective sensitivity to reconstruction based on the variance of the variables can be enhanced.

[0116] For the process of optimizing the variational autoencoder based on the self-attention mechanism in this application, in order to further clarify the effectiveness and usability of the intrusion detection model, this application gives its theoretical time complexity, that is, the intrusion detection model consists of two parts. The first is to use the self-attention mechanism to determine the potential variables. The time complexity of each layer is O(n 2 ·d), and then execute the variational autoencoder to obtain the detection effect. The time complexity of each layer is O(n·d 2 ), where n represents the sequence length and d represents the sequence dimension. Therefore, the total time complexity of the intrusion detection model is O(n 2 ·d)+O(n·d 2 ).

[0117] The VAE-based substation secondary system network intrusion detection method of this application is implemented in a semi-supervised manner, that is, only normal data samples are used to train the variational autoencoder. The trained VAE model will reconstruct normal input data with very low regularity, but cannot reconstruct abnormal data with low probability values. θ and encoder f φ The isotropic normal distribution in the original input variable space and the latent variable space is parameterized respectively, and the mean and variance parameters are used to calculate the probability of the original data generated from the isotropic normal distribution. In addition, the reconstruction probability RP is selected as the anomaly score to detect outliers. In the process of network intrusion detection based on VAE, The Monte Carlo estimate of is used as RP. By using the reconstruction probability as the anomaly score, it is more principled and objective than the previous intrusion detection method using the reconstruction error, and can perform more effective detection of abnormal network traffic.

[0118] In one embodiment, step 206 of determining whether the reconstruction probability exceeds a threshold and confirming whether the data to be detected is intrusion data according to the determination result may include:

[0119] If the judgment result is that the reconstruction probability exceeds the threshold, the data to be detected is confirmed to be intrusion data;

[0120] If the judgment result is that the reconstruction probability does not exceed the threshold, the data to be detected is confirmed to be normal data.

[0121] Specifically, after the intrusion detection model training is completed and the parameters are optimized, the model is used to process the data to be detected and perform anomaly detection on the data to be detected. When the network behavior is very different from the normal behavior learned by the intrusion detection model, a high reconstruction probability is usually observed. When the reconstruction probability of the input feature exceeds the threshold, the data can be regarded as intrusion data (attack traffic). That is, the intrusion detection model is used to process the data to be detected, and the processing result is obtained, and it is judged whether the reconstruction probability in the processing result exceeds the threshold. When the reconstruction probability exceeds the threshold, it is confirmed that the data to be detected is intrusion data, which is data that endangers the operation of the substation secondary system; when the reconstruction probability does not exceed the threshold, it is confirmed that the data to be detected is normal data, that is, non-intrusion data, which will not cause harm to the operation of the substation secondary system and is safe network data.

[0122] As mentioned above, the present application obtains an intrusion detection model by extracting a valid feature subset from the intrusion detection data set of the secondary system of the substation, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training. When the data to be detected is obtained, the intrusion detection model is used to process the data to be detected, and whether the data to be detected is intrusion data is confirmed by judging whether the reconstruction probability in the processing result exceeds the threshold. Among them, the training of VAE is performed by using the back propagation algorithm, and the reconstruction probability is calculated using the Monte Carlo gradient method combined with the reparameterization method. The present application can explicitly explore the potential changes and diversity implied in the training samples, and perform feature selection by using the mutual information method. Compared with directly using all the features in the data, the mutual information method reduces the complexity of the data model and speeds up the training speed, while also making the intrusion detection model have stronger generalization performance. This application introduces the self-attention mechanism into VAE to obtain the dynamic weight of each variable, and then integrates the change factors contained in the sample into the final latent variable, thereby effectively improving the model's detection performance for unknown attacks and effectively detecting abnormal network traffic; this application also uses the reconstruction probability as the anomaly score, which is more principled and objective than the reconstruction error, effectively improving the accuracy of detecting network attacks and enhancing the security of the secondary system of the smart substation.

[0123] It should be understood that although Figure 1-Figure 4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1-Figure 4At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0124] In one embodiment, Figure 5 As shown, a substation secondary system network intrusion detection device is provided, comprising:

[0125] The data acquisition module 110 is used to acquire the data to be detected;

[0126] The data processing module 120 is used to process the data to be detected using the intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from the intrusion detection data set of the substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training;

[0127] The judgment module 130 is used to judge whether the reconstruction probability exceeds a threshold, and to determine whether the data to be detected is intrusion data according to the judgment result.

[0128] In one embodiment, the data processing module 120 is also used to obtain an intrusion detection data set, and normalize each feature in the intrusion detection data set to obtain each normalized feature; calculate each mutual information value of each normalized feature; and extract a valid feature subset from the intrusion detection data set based on each mutual information value.

[0129] In one embodiment, the data processing module 120 is also used to encode each feature of the effective feature subset using a variational autoencoder to generate multiple intermediate latent variables; obtain the final latent variable by expanding the self-attention mechanism to the intermediate latent variables; and use a decoder to decode the final latent variable to obtain reconstructed data.

[0130] In one embodiment, the data processing module 120 is further used to calculate the cosine similarities between the query vector and each intermediate latent variable; convert the similarity scores of each cosine similarity into each alignment weight coefficient; and obtain the final latent variable by weighted summing the alignment weight coefficients.

[0131] In one embodiment, the data processing module 120 is further configured to construct an objective function through classification latent variables, posterior probabilities, prior probabilities, likelihood probabilities, and final latent variables.

[0132] In one embodiment, the data processing module 120 is further configured to obtain the reconstruction probability according to an average reconstruction error of a plurality of prior probability samples.

[0133] In one embodiment, the judgment module 130 is further configured to confirm that the data to be detected is intrusion data if the judgment result is that the reconstruction probability exceeds a threshold value; and to confirm that the data to be detected is normal data if the judgment result is that the reconstruction probability does not exceed the threshold value.

[0134] For the specific limitations of the substation secondary system network intrusion detection device, please refer to the limitations of the substation secondary system network intrusion detection method mentioned above, which will not be repeated here. Each module in the above-mentioned substation secondary system network intrusion detection device can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0135] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0136] In one embodiment, Figure 6 As shown, a substation secondary system network intrusion detection system is provided, including: an edge computing device and a substation secondary system; the edge computing device and the substation secondary system are communicatively connected;

[0137] The substation secondary system outputs intrusion detection data to the edge computing device;

[0138] The edge computing device receives the intrusion detection data and adds the intrusion detection data to the intrusion detection data set. The edge computing device extracts the effective feature subset from the intrusion detection data set and inputs the effective feature subset into the variational autoencoder based on the self-attention mechanism for training to obtain the intrusion detection model. The edge computing device sends the intrusion detection model to the substation secondary system.

[0139] The substation secondary system receives the intrusion detection model, and processes the data to be detected based on the intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the substation secondary system determines whether the reconstruction probability exceeds a threshold, and confirms whether the data to be detected is intrusion data based on the judgment result.

[0140] Specifically, this application migrates the model training task to the edge computing device outside the smart substation secondary system, and the smart substation secondary system only undertakes the detection task. The substation secondary system retains the samples (intrusion detection data) detected with training value and uploads them to the edge computing device through a high-speed, low-latency network, adding them to the intrusion detection data set for the next model training.

[0141] The edge computing device extracts the effective feature subset from the intrusion detection data set and inputs the effective feature subset into the variational autoencoder based on the self-attention mechanism for training (training the intrusion detection model) to obtain a trained intrusion detection model; the edge computing device sends the trained intrusion detection model to the substation secondary system in real time through a high-speed, low-latency network. The substation secondary system receives the trained intrusion detection model, updates the intrusion detection model received last time, and processes the data to be detected based on the intrusion detection model received this time to obtain the processing result; the processing result includes the reconstruction probability; the substation secondary system determines whether the reconstruction probability exceeds the threshold, and confirms whether the data to be detected is intrusion data based on the judgment result.

[0142] In one example, if Figure 7 As shown, the intrusion detection data set is a normal data set X, and the data to be detected is an abnormal data set x1, x2, ...x that may contain intrusion data. N , and set the threshold α; use the normal data set X to train the attention joint VAE model parameters, and process the data to be detected (the abnormal data set containing the intrusion data) through the trained intrusion detection module. When the data x in the data to be detected (the abnormal data set containing the intrusion data) is detected i The reconstruction probability RP i When it is greater than the threshold α, the data x is confirmed i is an outlier (i.e., intrusion data); when data x in the data to be detected (an abnormal data set containing intrusion data) is detected i The reconstruction probability RP i If the threshold α is not exceeded, the data x is confirmed. i is a normal value (i.e. normal data).

[0143] As mentioned above, the present application migrates the training task of the intrusion detection model to the edge computing device outside the secondary system of the substation. The secondary system only undertakes the detection task. The substation secondary system obtains the update of the intrusion detection model in real time through the high-speed network, and detects the data to be tested through the obtained intrusion detection module, and uploads the detected samples with training value to the edge computing device for model training. This application solves the problem that the computing resources of the substation secondary system are limited, but the intrusion detection is time-sensitive and has high detection accuracy requirements. Due to the migration of the intrusion detection model training task, the substation secondary system will save a lot of computing resources, while maintaining the stable operation of the substation secondary system itself, it also improves the intrusion detection speed. If the computing resources of the substation secondary system are sufficient, it is possible to choose not to migrate the training task out, and the steps in the above method embodiments can be directly implemented by the substation secondary system. In addition, the substation secondary system network intrusion system of the present application can effectively and accurately detect unknown attacks that invade the substation secondary system, effectively ensuring the operational safety of the substation secondary system.

[0144] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0145] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0146] In the description of this specification, the description with reference to the terms "some embodiments", "other embodiments", "ideal embodiments", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic descriptions of the above terms do not necessarily refer to the same embodiment or example.

[0147] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0148] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A substation secondary system network intrusion detection method, characterized in that: include: Obtain the data to be tested; The intrusion detection model is used to process the data to be detected to obtain a processing result; the processing result includes a reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from an intrusion detection data set of a substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training; wherein, the extraction of a valid feature subset from an intrusion detection data set of a substation secondary system includes: obtaining the intrusion detection data set, and normalizing each feature in the intrusion detection data set to obtain each normalized feature; respectively calculating each mutual information value of each normalized feature; according to each mutual information value, extracting the valid feature subset from the intrusion detection data set; the inputting of the valid feature subset into a variational autoencoder based on a self-attention mechanism for training includes: using the variational autoencoder to encode each feature of the valid feature subset to generate a plurality of intermediate latent variables; obtaining a final latent variable by extending the self-attention mechanism to the intermediate latent variables; and using a decoder to decode the final latent variable to obtain reconstructed data; It is determined whether the reconstruction probability exceeds a threshold, and whether the data to be detected is intrusion data is confirmed according to the determination result.

2. The substation secondary system network intrusion detection method according to claim 1 is characterized in that: The step of obtaining the final latent variable by extending the self-attention mechanism to the intermediate latent variable comprises: Calculating the cosine similarities between the query vector and each of the intermediate latent variables; Respectively converting the similarity scores of the cosine similarities into alignment weight coefficients; The final latent variable is obtained by performing weighted summation on the alignment weight coefficients.

3. The substation secondary system network intrusion detection method according to claim 1 is characterized in that: The step of inputting the effective feature subset into a variational autoencoder based on a self-attention mechanism for training further includes: An objective function is constructed by using the classification latent variables, the posterior probability, the prior probability, the likelihood probability and the final latent variable.

4. The substation secondary system network intrusion detection method according to claim 3 is characterized in that: The step of inputting the effective feature subset into a variational autoencoder based on a self-attention mechanism for training further includes: The reconstruction probability is obtained by sampling the prior probability several times and averaging the reconstruction errors.

5. The substation secondary system network intrusion detection method according to claim 1, characterized in that: The step of judging whether the reconstruction probability exceeds a threshold and confirming whether the data to be detected is intrusion data according to the judgment result includes: If the judgment result is that the reconstruction probability exceeds a threshold, then confirming that the data to be detected is intrusion data; If the judgment result is that the reconstruction probability does not exceed the threshold, the data to be detected is confirmed to be normal data.

6. A substation secondary system network intrusion detection device, characterized in that: include: A data acquisition module, used for acquiring data to be detected; A data processing module, used for processing the data to be detected by using an intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the intrusion detection model is obtained by extracting a valid feature subset from an intrusion detection data set of a substation secondary system, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training; wherein the extraction of the valid feature subset from the intrusion detection data set of the substation secondary system includes: obtaining the intrusion detection data set, and normalizing each feature in the intrusion detection data set to obtain each normalized feature; respectively calculating each mutual information value of each normalized feature; according to each mutual information value, extracting the valid feature subset from the intrusion detection data set; the inputting of the valid feature subset into a variational autoencoder based on a self-attention mechanism for training includes: using the variational autoencoder to encode each feature of the valid feature subset to generate a plurality of intermediate latent variables; by extending the self-attention mechanism to the intermediate latent variables, obtaining a final latent variable; using a decoder to decode the final latent variable to obtain reconstructed data; The judgment module is used to judge whether the reconstruction probability exceeds a threshold value, and confirm whether the data to be detected is intrusion data according to the judgment result.

7. A substation secondary system network intrusion detection system, characterized in that: include: Edge computing devices and substation secondary systems; The edge computing device is communicatively connected with the substation secondary system; The substation secondary system outputs intrusion detection data to the edge computing device; The edge computing device receives the intrusion detection data and adds the intrusion detection data to an intrusion detection data set; The edge computing device obtains an intrusion detection model by extracting a valid feature subset from the intrusion detection data set, and inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training; wherein, the extracting of the valid feature subset from the intrusion detection data set includes: normalizing each feature in the intrusion detection data set to obtain each normalized feature; respectively calculating each mutual information value of each normalized feature; extracting the valid feature subset from the intrusion detection data set according to each mutual information value; inputting the valid feature subset into a variational autoencoder based on a self-attention mechanism for training includes: using the variational autoencoder to encode each feature of the valid feature subset to generate multiple intermediate latent variables; obtaining a final latent variable by extending the self-attention mechanism to the intermediate latent variables; using a decoder to decode the final latent variable to obtain reconstructed data; the edge computing device sends the intrusion detection model to the substation secondary system; The substation secondary system receives the intrusion detection model, and processes the data to be detected based on the intrusion detection model to obtain a processing result; the processing result includes a reconstruction probability; the substation secondary system determines whether the reconstruction probability exceeds a threshold, and confirms whether the data to be detected is intrusion data based on the judgment result.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images