A power distribution network information system intrusion detection method and system

Abstract

The application discloses an intrusion detection method and system of a power distribution network information system, and the method comprises the following steps: acquiring panoramic data of the power distribution network information system; preprocessing the panoramic data of the power distribution network information system, and dividing the panoramic data of the power distribution network information system into a training set, a verification set and a test set; establishing a random forest intrusion detection model, and finding an optimal hyperparameter group for the random forest intrusion detection model according to the training set, the verification set and the test set; and determining whether the power distribution network information system is under network attack according to the optimal hyperparameter group. The embodiment of the application solves the problem of data imbalance, can more comprehensively and effectively acquire real-time data features, thereby improving the safe operation condition of the power distribution network information system, and has a faster processing speed, smaller algorithm overhead and smaller calculation cost.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer technology, and particularly relates to an intrusion detection method and system for a power distribution network information system. BACKGROUND

[0002] With the development of power grid informatization and networking, the security of the power distribution network information system is facing severe challenges. Power distribution is an important link of the power system, which directly faces power users and undertakes power supply services for power users. People have higher requirements for the reliability of the power distribution network information system and the power supply quality. Therefore, intrusion detection for the power distribution network information system is an important means to improve the reliability of power supply of the power distribution network.

[0003] In recent years, scholars have used various machine learning-based intrusion detection methods for power distribution network information systems to try to extract specific patterns to detect abnormal data. Hussain et al. proposed a two-stage hybrid classification method, which uses support vector machines and artificial neural networks for power distribution network information system intrusion detection. MA et al. use spectral clustering to extract features from network traffic and use a multi-layer neural network to detect power distribution network information system attack types. Erfani et al. propose a hybrid model that combines a deep belief network with a one-class vector machine to improve the classification effect of power distribution network information system intrusion detection.

[0004] However, the existing power distribution network information system intrusion detection method still has some problems: the algorithm has large time overhead and certain limitations. The computing power required by the neural network depends largely on the size of the data and the depth and complexity of the network. In comparison, the processing speed of the power distribution network information system intrusion detection model that fuses the neural network is slow, the algorithm overhead is too large, and the computing cost is high. The hyperparameter configuration of the existing intrusion detection model is mainly completed by manual search, which requires users to have professional background and practical experience, which makes the process of adjusting the hyperparameters not easy to reproduce. At the same time, as the number of hyperparameters and the range of values increase, since most people are not good at handling high-dimensional data and are prone to misinterpret or miss the trends and relationships of hyperparameters, the process becomes difficult to manage.

[0005] Application Content

[0006] The purpose of the embodiments of the present application is to provide an intrusion detection method and system for a power distribution network information system to solve the defects of slow processing speed and excessive algorithm overhead in the prior art.

[0007] To solve the above technical problems, the present application is implemented as follows:

[0008] In a first aspect, a power distribution network information system intrusion detection method is provided, comprising the following steps:

[0009] acquiring power distribution network information system panoramic data;

[0010] preprocessing the power distribution network information system panoramic data, and dividing the power distribution network information system panoramic data into a training set, a validation set and a test set;

[0011] establishing a random forest intrusion detection model, and finding the best hyperparameter group for the random forest intrusion detection model according to the training set, the validation set and the test set;

[0012] determining whether the power distribution network information system is under network attack according to the best hyperparameter group.

[0013] In a second aspect, a power distribution network information system intrusion detection system is provided, comprising:

[0014] an acquisition module configured to acquire power distribution network information system panoramic data;

[0015] a processing module configured to preprocess the power distribution network information system panoramic data, and divide the power distribution network information system panoramic data into a training set, a validation set and a test set;

[0016] a construction module configured to establish a random forest intrusion detection model, and find the best hyperparameter group for the random forest intrusion detection model according to the training set, the validation set and the test set;

[0017] a detection module configured to determine whether the power distribution network information system is under network attack according to the best hyperparameter group.

[0018] The embodiments of the present application use power distribution network information system panoramic data, search for the optimal hyperparameter group of the random forest learning algorithm, determine whether the power distribution network information system is under network attack, fully consider the correlation between multiple variables attacking the power distribution network, solve the problem of data imbalance, can more comprehensively and effectively obtain real-time data features, and thus improve the safe operation of the power distribution network information system, and the processing speed is fast, and the algorithm overhead and calculation cost are small. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a power distribution network information system intrusion detection method flowchart provided by the embodiments of the present application;

[0020] Figure 2 is a specific implementation diagram of the power distribution network information system intrusion detection method provided by the embodiments of the present application;

[0021] Figure 3is a structural schematic diagram of an intrusion detection system of a power distribution network information system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0023] The existing power distribution network information system intrusion detection method does not consider the imbalance of the power distribution network information system data, and the imbalance of the power distribution network information system data seriously affects the modeling and training of the power distribution network information system intrusion detection. There is a serious imbalance problem in the number of different categories of samples in the power distribution network intrusion detection environment, and the number of samples of some attack types is very small, so the trained model is prone to high false positives and false negatives. The imbalance data is processed by the undersampling method, which is easy to lose the majority class sample information, resulting in a decrease in the classification accuracy of the model for the majority class. The traditional oversampling method is to perform sample oversampling through interpolation operation, which is easy to create redundant data samples and increase the training difficulty of the model. With the development of the power distribution network, more and more network intrusion attack methods are becoming intelligent and diversified, and the traditional sampling method is not suitable for processing the imbalance data of the power distribution network.

[0024] The embodiments of the present application aim to overcome the deficiencies of the above-mentioned existing methods, and provide a power distribution network information system intrusion detection method, specifically a power distribution network information system intrusion detection method based on hyperparameter optimization random forest. The detection method adopted by the embodiments of the present application is as follows: first, a panoramic database of the power distribution network information system is built in combination with the power distribution network grid topology, switch state, device parameters, customer load, operating state and device historical operating data, specifically including three-phase voltage, three-phase current, power factor, active power, reactive power, active energy, etc. Second, the acquired panoramic data of the power distribution network information system is subjected to Borderline-SMOTE + Tomek Links hybrid sampling. Third, the sampled panoramic data of the power distribution network information system is subjected to MIN-MAX normalization processing, and the data is divided into a training set, a validation set and a test set. Finally, digital modeling is realized based on the power distribution network information system database, a power distribution network information system intrusion detection method based on hyperparameter optimization random forest is applied to the power distribution network information system, and network illegal intrusion alarm is realized.

[0025] The power distribution network information system intrusion detection method provided by the embodiments of the present application will be described in detail below in combination with the drawings, through specific embodiments and application scenarios.

[0026] As Figure 1 shown, a flow chart of an intrusion detection method of a power distribution network information system provided by an embodiment of the present application is provided, and the method comprises the following steps:

[0027] Step 101, acquiring panoramic data of the power distribution network information system.

[0028] Specifically, a panoramic database of the power distribution network information system can be built by the panoramic data of the power distribution network information system. The panoramic data of the power distribution network information system comprises power distribution network topology, switch state, device parameters, customer load, operating state and device historical operating data.

[0029] Step 102, preprocessing the panoramic data of the power distribution network information system, and dividing the panoramic data of the power distribution network information system into a training set, a validation set and a test set.

[0030] Specifically, the panoramic data of the power distribution network information system can be mixed sampled and normalized, and the processed panoramic data of the power distribution network information system can be divided into a training set, a validation set and a test set.

[0031] In this embodiment, the boundary samples in the panoramic data of the power distribution network information system can be classified, and the boundary minority samples in the panoramic data of the power distribution network information system can be synthesized according to the distribution state of the boundary samples; according to the distance between two sample points in the new synthesized data set, it is determined whether the two sample points can form a TomekLinks pair, if yes, one of the two sample points is determined as noise, and the sample is deleted; if not, the two sample points are determined as safe samples.

[0032] Step 103, establishing a random forest intrusion detection model, and finding the best hyperparameter group for the random forest intrusion detection model according to the training set, the validation set and the test set.

[0033] Step 104, determining whether the power distribution network information system exists network attack according to the best hyperparameter group.

[0034] In this embodiment, the panoramic data of the power distribution network information system can also be updated in real time.

[0035] In this embodiment, the panoramic data of the power distribution network information system is used to search for the optimal hyperparameter group of the random forest learning algorithm, to determine whether the power distribution network information system exists the possibility of being attacked by network, fully considers the correlation between multiple variables of the attack power distribution network, solves the problem of data imbalance, can more comprehensively and effectively obtain real-time data features, thereby improving the safe operation of the power distribution network information system, and the processing speed is faster, and the algorithm overhead and calculation cost are smaller.

[0036] The power distribution network information system intrusion detection method provided by the embodiment of the application will be described in detail below in combination with specific embodiments and application scenarios, and the specific implementation steps are as follows: Figure 2

[0037] Step 1: Read the database: obtain the original data composed of the data interface between the power distribution network information system data acquisition and monitoring system, the power distribution network framework topology, the switch state, the equipment parameter, the customer load, the running state and the historical running data of the equipment panoramic data set within a period of time;

[0038] Step 2: Data preprocessing: the Borderline-SMOTE + Tomek Links hybrid sampling algorithm is used to preprocess the unbalanced data of the power distribution network information system panoramic database. Firstly, the Borderline-SMOTE algorithm is used to oversample the boundary samples of the minority class, interpolate in this boundary sample area, synthesize new samples, and in order to avoid the invasion of new synthesized samples into the majority class, the Tomek Links algorithm is used to find and delete these invasion samples. After balancing processing, a relatively balanced data set can be obtained. It is used as the modeling data matrix library of the power distribution network information system intrusion detection model;

[0039] Step 3: Min-Max normalization is performed on the power distribution network information system panoramic data set in step 2 to eliminate the influence of data feature dimensions, and the power distribution network information system panoramic data set is divided into a training set, a validation set and a test set;

[0040] Step 4: Establish a power distribution network information system intrusion detection method based on hyperparameter optimization random forest, and use Bayesian search to find the best hyperparameter set for the model according to the data set divided in step 3;

[0041] Step 5: Real-time dynamic update of the power distribution network information system panoramic data set in step 3 is used to monitor the safe operation of the power distribution network information system.

[0042] Wherein, step 2 includes the following implementation process:

[0043] Step 2.1: Analyze the historical records of the power distribution network information system under attack and the query of related literature, find the relevance of historical data variables and the power distribution network information system under attack, and convert the corresponding historical data into features so that they can be applied to the method described in this paper;

[0044] ​Step 2.2: Perform Borderline-SMOTE processing on the panoramic data of the distribution network information system from Step 2.1. This mainly involves classifying the boundary samples of the panoramic data of the distribution network information system, and then synthesizing the minority class samples of the boundary of the panoramic data of the distribution network information system according to the basic principles of the algorithm. Considering the distribution status of the boundary samples of the panoramic data of the distribution network, the internal structure of the newly synthesized data is made more reasonable.

[0045] Step 2.3: Perform Tomek Links processing on the synthesized panoramic dataset of the distribution network information system from Step 2.2. This mainly involves comparing the distance between two sample points in the newly synthesized dataset to determine if these two sample points can form a Tomek Link pair. If they can, it indicates that one of the two sample points in the newly synthesized dataset is noise, and that sample is deleted. Otherwise, it is a safe sample. The Tomek Links algorithm is mainly used to solve the overfitting problem of the model.

[0046] Furthermore, step 2.2 includes the following implementation process:

[0047] Step 2.2.1: First, the mean method is used to analyze the imbalanced class dataset in the panoramic dataset of the distribution network information system. Missing values ​​were added, and redundant and irrelevant features were removed;

[0048] Step 2.2.2: Next, in the processed dataset... In the middle, for minority class sample sets Each sample Calculate the nearest one One sample, The number of minority class samples in the nearest neighbors is denoted as ;

[0049] Step 2.2.3: If That is, the distance from the sample point Recent Each sample is a multi-class sample, and it is believed that... This is a noise point; do not perform any operation.

[0050] Step 2.2.4: If Then the sample points If the number of samples from the multiple classes is greater than the number of samples from the minority class, then the sample point Samples deemed prone to misclassification are placed in the danger set;

[0051] Step 2.2.5: If Then the sample points are considered More than half of the surrounding samples are minority class samples, which is considered... is a safe point, and no operation is performed;

[0052] Step 2.2.6: For each sample in the danger set Randomly select, as a criterion of Euclidean distance, the nearest sample from the minority sample set Randomly select several samples from the Generate new samples according to the formula , wherein represents a newly generated minority sample, represents a minority sample, represents a random number, represents a randomly generated neighbor sample.

[0053] Step 2.2.7: For each sample in the danger set Repeat steps 1.1.2-1.1.6 until the training set reaches the oversampling ratio Stop synthesizing new samples, and put the synthesized samples into the new power grid information system panoramic dataset ;

[0054] Further, step 2.3 includes the following implementation process:

[0055] Step 2.3.1: If the sample and the sample are two sample points of different classes in the power grid information system panoramic dataset , calculate the Euclidean distance between the two sample points ;

[0056] Step 2.3.2: Check whether , so that or ;

[0057] Step 2.3.3: If not, it means that is a Tomek Links pair, and the sample belonging to the majority class in the Tomek Links pair is deleted;

[0058] Step 2.3.4: Otherwise, repeat steps 1.2.1-1.2.3 until all sample points are found, and generate the final balanced dataset ;

[0059] Among them, step 4 includes the following implementation process:

[0060] Step 4.1: Establish a random forest intrusion detection model, and divide the power grid information system panoramic dataset into a training set and a validation set Meanwhile, the optimal hyperparameters for power grid information system intrusion detection are evaluated;

[0061] Step 4.2: Randomly initialize the hyperparameters of the power grid information system intrusion detection model The error probability distribution of the objective function of the hyperparameter set And the hyperparameter set Where Is the actual value of the objective function of the hyperparameter set ;

[0062] Step 4.3: Solve Get a new set of hyperparameters Where Is the acquisition function of the power grid information system intrusion detection model, which can find more favorable search areas in the search space;

[0063] Step 4.4: Evaluate Through the power grid information system intrusion detection model objective function ;

[0064] Step 4.5: Add the result to the power grid information system intrusion detection model knowledge base ;

[0065] Step 4.6: Estimate the new Model according to the power grid information system intrusion detection model knowledge base ;

[0066] Step 4.7: Calculate a new set of hyperparameters Combined with the power grid information system intrusion detection new model And power grid information system intrusion detection model knowledge base information ;

[0067] Step 4.8: The power grid information system intrusion detection new model is trained iteratively, the weights and biases of the power grid information system intrusion detection model are updated, and k-fold cross-validation is performed;

[0068] Step 4.9: Evaluate the hyperparameter set through the error score of the power grid information system intrusion detection new model, where And Are the true and predicted results, respectively; Is an indicator function, which is 1 if the parameter is , otherwise 0; Indicates the validation set of the power grid information system panoramic data set; and add the hyperparameter set and error score to the knowledge base ;

[0069] ​Step 4.10: iteration is started from step 4.8, and the optimization process converges;

[0070] Step 4.11: select the hyperparameter set that makes the minimum And according to this set of hyperparameters and the test set, the index accuracy, precision, recall and F1-score of the power grid information system intrusion detection model are calculated.

[0071] The embodiment of the application provides a panoramic data driven power grid information system intrusion detection method, which mainly relies on data features such as data interfaces between power grid information system data acquisition and monitoring systems, actual network topology, switch state, device parameters, customer load and running state to mine the internal information, and uses a random forest learning algorithm to establish a mathematical model of the power grid information system intrusion detection process. The panoramic data driven power grid information system intrusion detection method in the embodiment of the application greatly improves the dependence of the monitoring method on the knowledge mechanism and improves the safe operation of the power grid information system. The panoramic data of the power grid information system is used, and a Bayesian search algorithm is used to search for the optimal hyperparameter set of the random forest learning algorithm to determine whether the power grid information system is attacked, and the process data covers panoramic data such as power system network architecture, power equipment operating parameters and power distribution line load conditions, fully considers the correlation between multiple variables attacking the power grid, solves the problem of data imbalance, and can more comprehensively and effectively obtain real-time data features.

[0072] As shown in Figure 3 , a power grid information system intrusion detection system provided by the embodiment of the application comprises:

[0073] The acquisition module 310 is configured to acquire panoramic data of the power grid information system.

[0074] The panoramic data of the power grid information system comprises power grid network topology, switch state, device parameters, customer load, running state and device historical operation data.

[0075] The acquisition module 310 is specifically configured to build a panoramic database of the power grid information system composed of the panoramic data of the power grid information system.

[0076] The processing module 320 is configured to preprocess the panoramic data of the power grid information system, and divide the panoramic data of the power grid information system into a training set, a validation set and a test set.

[0077] Specifically, the processing module 320 is specifically configured to perform mixed sampling and normalization processing on the power grid information system panoramic data, and divide the power grid information system panoramic data into a training set, a validation set and a test set.

[0078] In this embodiment, the processing module 320 is specifically configured to classify boundary samples in the power grid information system panoramic data, and synthesize boundary minority samples in the power grid information system panoramic data according to a distribution state of the boundary samples; determine whether two sample points in a new synthesized data set can form a Tomek Links pair according to a distance between the two sample points, if yes, determine one of the two sample points as noise and delete the sample; and if not, determine the two sample points as safe samples.

[0079] The construction module 330 is configured to construct a random forest intrusion detection model, and find an optimal hyperparameter group for the random forest intrusion detection model according to the training set, the validation set and the test set.

[0080] The detection module 340 is configured to determine whether the power grid information system exists network attack according to the optimal hyperparameter group.

[0081] In this embodiment, the system further includes:

[0082] The updating module is configured to update the power grid information system panoramic data in real time.

[0083] The embodiments of the present application use power grid information system panoramic data, search for an optimal hyperparameter group of a random forest learning algorithm, determine whether the power grid information system exists network attack, fully consider the correlation between multiple variables of attack power grid, solve the problem of data imbalance, can more comprehensively and effectively obtain real-time data features, and thus improve the safe operation of the power grid information system, and the processing speed is faster, and the algorithm overhead and calculation cost are smaller.

[0084] It should be noted that in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusion, so that processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or further include elements inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of additional identical elements in the process, method, article or device including the element.

[0085] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, also can be through hardware, but many cases the former is the better embodiment. Based on such understanding, the technical solutions of the present application essentially or say the part of the contribution to the prior art can be embodied in the form of software products, the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disc), including a number of instructions to make a terminal (may be a mobile phone, computer, server, air conditioner, or network equipment, etc.) executes the method described in various embodiments of the present application.

[0086] The embodiments of the present application are described above in conjunction with the drawings, but the present application is not limited to the above-mentioned specific embodiments, the above-mentioned specific embodiments are only illustrative, but not limited, those skilled in the art can make many forms without departing from the purpose of the present application and the scope of the claims under the inspiration of the present application, all belong to the protection of the present application.

Claims

1. A method for intrusion detection of a power distribution grid information system, characterized in that, The method comprises the following steps: obtaining power grid information system panoramic data; the power grid information system panoramic data comprises power grid network topology, switch state, equipment parameter, customer load, running state and equipment historical operation data; preprocessing the power grid information system panoramic data, and dividing the power grid information system panoramic data into a training set, a verification set and a test set; establishing a random forest intrusion detection model, and finding an optimal hyperparameter group for the random forest intrusion detection model according to the training set, the verification set and the test set, including the following implementation process: Step 4.1: Establishing the Random Forest Intrusion Detection Model and Dividing the Power Grid Information System Panorama Dataset into Training Set and Validation Set while evaluating the optimal hyperparameters for power grid information system intrusion detection; Step 4.2: Randomly initialize power grid information system intrusion detection model hyperparameter error probability distribution and hyperparameter set where is the actual value of the objective function for the hyperparameter set ​ Step 4.3: Solving Obtain a new set of hyperparameters where is the acquisition function for the power grid information system intrusion detection model, which can find more favorable search areas in the search space; Step 4.4: Power distribution grid information system intrusion detection model objective function Evaluation ; Step 4.5: Add results to power grid information system intrusion detection model knowledge base In the middle; Step 4.6: Power distribution grid information system intrusion detection model knowledge base Estimate new Model; Step 4.7: Incorporating power grid information system intrusion detection new model and power grid information system intrusion detection model knowledge base information computing new hyperparameter set ; Step 4.8: the power grid information system intrusion detection new model is trained and iterated, the weight and bias of the power grid information system intrusion detection model are updated, and k-fold cross-validation is performed; Step 4.9: Error score by power grid information system intrusion detection new model The hyperparameter set is evaluated, wherein, and are the true and predicted outcomes, respectively; is an indicator function that takes the value 1 if the parameter is in the set and 0 otherwise; denotes the validation set of the power grid information system panoramic dataset; and the hyperparameter set and error score match are added to the knowledge base hub ; Step 4.10: iteration is started from step 4.8 to make the optimization process converge; Step 4.11: Selecting the hyperparameter set that minimizes the validation loss and computes the indices accuracy, precision, recall, and F1-score of the power grid information system intrusion detection model based on this set of hyperparameters and the test set. determining whether the power grid information system is under network attack according to the optimal hyperparameter group; the preprocessing of the power grid information system panoramic data specifically comprises: classifying boundary samples in the power grid information system panoramic data, and synthesizing boundary minority class samples in the power grid information system panoramic data according to the distribution state of the boundary samples; judging whether two sample points in a new synthesized data set can form a TomekLinks pair according to the distance between the two sample points, if yes, determining that one of the two sample points is noise and deleting the sample; if not, determining that the two sample points are safe samples.

2. The method of claim 1, wherein, the obtaining of the power grid information system panoramic data specifically comprises: building a power grid information system panoramic database composed of the power grid information system panoramic data; the preprocessing of the power grid information system panoramic data specifically comprises: performing mixed sampling and normalization processing on the power grid information system panoramic data.

3. The method of claim 1, wherein, It also comprises: real-time dynamic updating the power grid information system panoramic data.

4. An intrusion detection system for an electric power distribution grid information system, characterized by It comprises: an acquisition module for acquiring power grid information system panoramic data; the power grid information system panoramic data comprises power grid network topology, switch state, equipment parameter, customer load, running state and equipment historical operation data; a processing module for preprocessing the power grid information system panoramic data, and dividing the power grid information system panoramic data into a training set, a verification set and a test set; a construction module for establishing a random forest intrusion detection model, and finding an optimal hyperparameter group for the random forest intrusion detection model according to the training set, the verification set and the test set, including the following implementation process: Step 4.1: Establishing the Random Forest Intrusion Detection Model and Dividing the Power Grid Information System Panorama Dataset into Training Set and Validation Set while evaluating the optimal hyperparameters for power grid information system intrusion detection; Step 4.2: Randomly initialize power grid information system intrusion detection model hyperparameter error probability distribution and hyperparameter set where is the actual value of the objective function for the hyperparameter set ​ Step 4.3: Solving Obtain a new set of hyperparameters where is the acquisition function of the power grid information system intrusion detection model, which can find more favorable search areas in the search space; Step 4.4: Power distribution grid information system intrusion detection model objective function evaluation ; Step 4.5: Add results to power grid information system intrusion detection model knowledge base In the middle; Step 4.6: Power distribution grid information system intrusion detection model knowledge base Estimate new model; Step 4.7: Incorporating power grid information system intrusion detection new model and power grid information system intrusion detection model knowledge base information computing new hyperparameter set ; Step 4.8: the power grid information system intrusion detection new model is trained and iterated, the weight and bias of the power grid information system intrusion detection model are updated, and k-fold cross-validation is performed; Step 4.9: Error score by power grid information system intrusion detection new model evaluating the hyperparameter set, wherein, and are the true and predicted outcomes, respectively; is an indicator function that takes the value 1 if the parameter is true and 0 otherwise; denotes the validation set of the power grid information system panoramic dataset; and the hyperparameter set and error score match are added to the knowledge base hub ; Step 4.10: iteration is started from step 4.8 to make the optimization process converge; Step 4.11: Selecting the hyperparameter set that minimizes the validation loss and computes the indices accuracy, precision, recall, and F1-score of the power grid information system intrusion detection model based on this set of hyperparameters and the test set. a detection module for determining whether the power grid information system is under network attack according to the optimal hyperparameter group; The processing module is specifically configured to classify boundary samples in the power distribution network information system panoramic data, and synthesize boundary minority class samples in the power distribution network information system panoramic data according to a distribution state of the boundary samples; and determine whether two sample points in a new synthesized data set can form a TomekLinks pair according to a distance between the two sample points, if yes, determine one of the two sample points as noise, and delete the sample; and if not, determine the two sample points as safe samples.

5. The system of claim 4, wherein, The acquisition module is specifically configured to build a power distribution network information system panoramic database composed of the power distribution network information system panoramic data. The processing module is specifically configured to perform mixed sampling and normalization processing on the power distribution network information system panoramic data, and divide the power distribution network information system panoramic data into a training set, a validation set and a test set.

6. The system of claim 4, wherein, Further comprising: An updating module configured to update the power distribution network information system panoramic data in real time and dynamically.

Images