A method and system for classifying network attacks on distribution networks

Abstract

This application discloses a method and system for classifying network attacks on distribution networks. The method includes the following steps: preprocessing the NSL-KDD dataset based on state perception information of the distribution network; building a CNN-LSTM distribution network attack classification model based on a channel attention mechanism; performing feature fusion on the CNN-LSTM distribution network attack classification model based on a channel attention mechanism; training the CNN-LSTM distribution network attack classification model based on a channel attention mechanism using the NSL-KDD dataset; verifying the classification accuracy of the CNN-LSTM distribution network attack classification model based on a channel attention mechanism; and outputting the network attack classification results for the distribution network through a softmax function. This application can better eliminate the impact of small-category attack samples on the operation of the distribution network.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically relates to a method and system for classifying network attacks on distribution networks. Background Art

[0002] As the core equipment for distributing electricity in modern power grids, the health of the distribution network directly impacts the normal operation of the power system. However, distribution networks operate in complex environments and are highly susceptible to cyberattacks. Therefore, real-time monitoring of distribution network transmission data, identifying security incidents, and promptly detecting security threats and attackers is crucial.

[0003] As an important active security defense technology, distribution network intrusion detection aims to detect and identify network attack events by collecting network data and designing corresponding processing algorithms. In the prior art, a distribution network intrusion detection algorithm based on K-means is proposed. It relies heavily on researchers' understanding of data and extraction of feature vectors. When there is a lot of noise in the data, clustering algorithms are difficult to achieve good results. Compared with unsupervised learning, supervised learning algorithms have higher learning efficiency. Commonly used supervised learning methods in intrusion detection include SVM and Bayesian network. SVM and OCSVM are similar in that they can only be used for binary classification and lack the ability to accurately detect attack types. In addition, the prior art also proposes a distribution network intrusion detection algorithm based on multi-classification SVM, which achieves the ability to accurately detect multiple attack types by combining multiple SVM models. However, the above method is still shallow learning in nature and has the following shortcomings: (1) The feature parameters required by the classifier must be manually specified and are highly subjective; (2) Shallow learning is difficult to represent the complex nonlinear mapping relationship between high-dimensional heterogeneous data and type labels; (3) The global and local features of the data are not considered; (4) The data samples are unbalanced. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a method and system for classifying network attacks on distribution networks, so as to solve the problems of decreased model classification accuracy and inaccurate classification caused by imbalanced data samples in distribution networks.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, a method for classifying network attacks against a distribution network is provided, comprising the following steps:

[0007] The NSL-KDD dataset is preprocessed based on the state perception information of the distribution network;

[0008] Building a convolutional neural network (CNN)-long short-term memory (LSTM) distribution network attack classification model based on a channel attention mechanism. The CNN-LSTM distribution network attack classification model based on a channel attention mechanism adopts a serial form and includes an input layer, a two-dimensional convolutional layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory (LSTM) network layer, a tiling layer, a fully connected layer, and an overfitting layer.

[0009] The CNN-LSTM distribution network network attack classification model based on the channel attention mechanism is subjected to feature fusion, and the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism is trained using the NSL-KDD dataset. The classification accuracy of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism is verified, and the network attack classification result for the distribution network is output through the Softmax function.

[0010] Secondly, a classification system for network attacks on distribution networks is provided, including:

[0011] The preprocessing module is used to preprocess the NSL-KDD dataset based on the state perception information of the distribution network;

[0012] A construction module for building a convolutional neural network (CNN)-long short-term memory (LSTM) distribution network attack classification model based on a channel attention mechanism. The CNN-LSTM distribution network attack classification model based on a channel attention mechanism adopts a serial form and includes an input layer, a two-dimensional convolutional layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory network layer, a tiling layer, a fully connected layer, and an overfitting layer.

[0013] A classification module is used to perform feature fusion on the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, train the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism using the NSL-KDD dataset, verify the classification accuracy of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, and output the network attack classification result for the distribution network through the Softmax function.

[0014] The embodiment of the present application solves the problems of decreased model classification accuracy and inaccurate classification caused by the imbalance of distribution network data samples by constructing a CNN-LSTM distribution network attack classification method based on the channel attention mechanism, thereby better eliminating the impact of small-category attack samples of the distribution network on the operation of the distribution network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of a method for classifying network attacks on a distribution network provided by an embodiment of the present application;

[0016] Figure 2 This is a specific implementation diagram of the network attack classification method for the distribution network provided in an embodiment of the present application;

[0017] Figure 3 This is a structural diagram of a network attack classification system for distribution networks provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0019] like Figure 1 FIG. 1 is a flow chart of a method for classifying network attacks on a power distribution network according to an embodiment of the present application, comprising the following steps:

[0020] Step 101: pre-process the NSL-KDD dataset based on the state perception information of the distribution network.

[0021] Specifically, the NSL-KDD dataset can be classified and a mapping dictionary can be established based on the state perception information of the distribution network. Feature encoding, data merging and feature normalization can be performed on discrete features in the data features, and adaptive comprehensive oversampling technology can be used to increase the small sample set of network attacks.

[0022] Among them, there are three character-type discrete features in the NSL-KDD dataset: "protocol_type", "service" and "flag".

[0023] Step 102: Build a CNN-LSTM distribution network attack classification model based on the channel attention mechanism.

[0024] Specifically, a convolutional neural network can be used to perform two-dimensional convolution on the data collected in the distribution network, converting the one-dimensional space into a two-dimensional space; a long short-term memory network can be used to perform bidirectional extraction of temporal features of the data collected from the distribution network, and a channel attention mechanism can be introduced to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data.

[0025] Among them, the CNN (Convolution Neural Network)-LSTM (Long Short-Term Memory) distribution network attack classification model based on the channel attention mechanism adopts a series form, including an input layer, a two-dimensional convolution layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory network layer, a tiling layer, a fully connected layer and an overfitting layer.

[0026] In this embodiment, the dimension of the input data can be converted into a tensor of (114, 1) based on the characteristics of the distribution network network attack classification model, and then sent to the input layer; the tensor is subjected to two-dimensional convolutional spatial feature extraction, and a channel attention mechanism is introduced to enhance the key features of the sample data; the data is reconstructed to obtain a dimension that can be input into the long short-term memory network; the long short-term memory network layer is used to perform bidirectional extraction of the time series features of the data in the distribution network, and the flattening layer is used to flatten the data into a one-dimensional feature vector; a fully connected layer is used to complete feature recognition, and an overfitting layer is added for regularization. The fully connected layer uses a Softmax function, and the number of neurons is 5.

[0027] Step 103: Perform feature fusion on the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, use the NSL-KDD dataset to train the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, verify the classification accuracy of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, and output the network attack classification result for the distribution network through the Softmax function.

[0028] The embodiment of the present application solves the problems of decreased model classification accuracy and inaccurate classification caused by the imbalance of distribution network data samples by constructing a CNN-LSTM distribution network attack classification method based on the channel attention mechanism, thereby better eliminating the impact of small-category attack samples of the distribution network on the operation of the distribution network.

[0029] The following combination Figure 2 The network attack classification method for the distribution network provided by the embodiment of the present application is described in detail through specific embodiments and application scenarios. The specific implementation steps are as follows:

[0030] Data preprocessing: First, the NSL-KDD raw data is classified into five categories based on the state perception information of the distribution network, and a mapping dictionary is established. Secondly, feature encoding and data merging are performed on the discrete features in the data features. Then, feature normalization is performed to eliminate the impact of the dimension on the distribution network attack classification model. Finally, adaptive comprehensive oversampling technology is used to increase the small sample set of network attacks and eliminate the impact of network attack data imbalance on the distribution network attack classification model.

[0031] Model Construction: First, a convolutional neural network is used to perform two-dimensional convolution on the data collected from the distribution network, converting the one-dimensional space into a two-dimensional space and extracting the spatial features of the distribution network data. Second, a long short-term memory network is used to extract bidirectional temporal features from the data collected from the distribution network, addressing the problem of global data features. A channel attention mechanism is then introduced to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data and improving the overall performance of the CNN-LSTM distribution network attack classification model based on the channel attention mechanism. The CNN-LSTM distribution network attack classification model based on the channel attention mechanism adopts a cascade structure, including an input layer, a two-dimensional convolution layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory network layer, a tiling layer, a fully connected layer, and an overfitting layer.

[0032] Model training: First, feature fusion is performed on the established CNN-LSTM distribution network attack classification model based on the channel attention mechanism. Second, the model is trained using NSL-KDD data and 10% of the training data is used as validation data to verify the classification accuracy of the CNN-LSTM distribution network attack classification model based on the channel attention mechanism. Finally, the classification results are output through the Softmax function.

[0033] Among them, data preprocessing specifically includes the following implementation processes:

[0034] There are many types of attacks on the distribution network raw data. We categorize them into five major categories and create a mapping dictionary. Load the data, which contains 43 columns. The first 41 columns represent network traffic characteristics, the 42nd column represents the attack type, and the 43rd column indicates the ease of classification of the sample. A larger number indicates the highest number of correctly classified samples. The maximum value is 21, indicating that all models correctly classify the sample. Column 43 is irrelevant to network traffic characteristics and will be deleted. Categorize the various attack types into the five major categories.

[0035] There are three character-based discrete features in the NSL-KDD data: "protocol_type", "service", and "flag". These three discrete character-based features are encoded and converted into numbers. Since the converted values ​​will affect the weight of the same feature in the sample, an N-bit state register is used to encode N states.

[0036] Since the test set and the training set have different types, the dimensions need to be aligned, and the empty values ​​in the dataset are filled with NAN to merge the data. In order to eliminate the size effect between features and speed up the gradient descent of the neural network, feature normalization is performed. The method for normalizing NSL-KDD is Normalization, the function principle is as follows:

[0037]

[0038] in, and Represent the minimum and maximum values ​​of the sample data respectively, Map the results to between.

[0039] The number of network attack samples suffered by the distribution network is smaller than that of normal samples, but the consequences of the attacks are very serious. Therefore, adaptive comprehensive oversampling technology is used to expand the small sample set of network attacks according to methods such as learning difficulty and probability distribution to solve the impact of data imbalance on the distribution network network attack classification model.

[0040] Furthermore, the steps of expanding the small sample set of network attacks include the following specific implementation processes:

[0041] Calculating imbalance , where ;

[0042] Calculate the number of synthetic minority samples: , where Indicates the degree of imbalance after adding synthetic samples. It means that after adding the synthetic samples, the majority class and the minority class are completely balanced, and G is equal to the difference between the minority class and the majority class;

[0043] For each sample of the minority class , find out where they are dimensional space Nearest neighbors, and calculate their ratio , where yes of The number of majority classes in the neighborhood. Therefore ;

[0044] according to Regularization ,So is the probability distribution , calculate the majority class situation around each minority class sample;

[0045] According to each minority sample Calculate the number of synthetic samples : , where is the total number of synthetic samples;

[0046] Around each minority class sample to be synthesized Each neighbor selects a minority class sample and synthesizes it according to the following equation:

[0047] The model building includes the following specific implementation processes:

[0048] First, based on the characteristics of the distribution network attack classification model, the input data is converted into a (114, 1) tensor and then fed into the input layer. This tensor undergoes two-dimensional convolutional spatial feature extraction, and a channel attention mechanism is introduced to enhance the key features of the sample data, addressing the local feature issues of the sample data in the distribution network classification model. The data is then reconstructed to obtain dimensions suitable for input into a long-short-term memory (LSTM) network. The LSTM network layer is used to bidirectionally extract temporal features from the distribution network data, addressing the global feature issues of the data in the distribution network attack classification model through long-term memory. The data is then flattened into a one-dimensional feature vector using the flattening layer. Finally, a fully connected layer is used to complete feature recognition in the above steps, and an overfitting regularization layer is added to prevent overfitting of the CNN-LSTM distribution network attack classification model based on the channel attention mechanism. When the model handles a five-class classification problem, the last fully connected layer uses the softmax activation function with 5 neurons.

[0049] The calculation formula of the Softmax function is as follows:

[0050]

[0051] Among them, model training includes the following specific implementation processes:

[0052] The CNN-LSTM model is integrated with the channel attention mechanism. The model is trained using training data and training labels, and the optimal model parameters are adjusted. Finally, 10% of the training set is used as the validation set to evaluate the model. The final result is classified using Softmax.

[0053] The embodiment of the present application builds a CNN-LSTM fusion model for the data collected in the distribution network; uses a convolutional neural network to perform two-dimensional convolution on the data collected in the distribution network, converts the one-dimensional space into a two-dimensional space, and extracts the spatial features of the data in the distribution network; then uses a long short-term memory network to perform bidirectional extraction of temporal features on the data collected from the distribution network to solve the problem of global data features; then introduces a channel attention mechanism to enhance the key features of the data collected from the distribution network, and then extracts local features of the data, improving the overall performance of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism. Finally, the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism is used for fusion training to solve the problem of incomplete feature learning of a single neural network. It can detect various types of attack data in the distribution network in real time and ensure the safe and stable operation of the distribution network.

[0054] like Figure 3As shown, a network attack classification system for a power distribution network in an embodiment of the present application includes:

[0055] The preprocessing module 310 is configured to preprocess the NSL-KDD dataset according to the state perception information of the distribution network.

[0056] Specifically, the preprocessing module 310 is used to classify the NSL-KDD data set according to the state perception information of the distribution network and establish a mapping dictionary, perform feature encoding, data merging and feature normalization on discrete features in the data features, and use adaptive comprehensive oversampling technology to increase the small sample set of network attacks.

[0057] Among them, there are three character-type discrete features in the NSL-KDD dataset: "protocol_type", "service" and "flag".

[0058] Building module 320, used to build a convolutional neural network CNN-long short-term memory network LSTM distribution network attack classification model based on the channel attention mechanism. The CNN-LSTM distribution network attack classification model based on the channel attention mechanism adopts a series form, including an input layer, a two-dimensional convolution layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory network layer, a tiling layer, a fully connected layer and an overfitting layer.

[0059] Specifically, module 320 is constructed to perform two-dimensional convolution on the data collected in the distribution network using a convolutional neural network to convert the one-dimensional space into a two-dimensional space; bidirectional extraction of temporal features of the data collected from the distribution network is performed through a long short-term memory network, and a channel attention mechanism is introduced to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data.

[0060] In this embodiment, module 320 is constructed, which is specifically used to convert the dimension of the input data into a tensor of (114, 1) based on the characteristics of the distribution network network attack classification model, and then send it to the input layer; perform two-dimensional convolution space feature extraction on the tensor, and introduce a channel attention mechanism to enhance the key features of the sample data; reconstruct the data to obtain a dimension that can be input into the long short-term memory network; use the long short-term memory network layer to perform bidirectional extraction of the time series features of the data in the distribution network, and use the flattening layer to flatten the data into a one-dimensional feature vector; use a fully connected layer to complete feature recognition, and add an overfitting layer for regularization. The fully connected layer uses the Softmax function, and the number of neurons is 5.

[0061] The classification module 330 is used to perform feature fusion on the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, use the NSL-KDD dataset to train the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, verify the classification accuracy of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, and output the network attack classification result for the distribution network through the Softmax function.

[0062] The embodiment of the present application solves the problems of decreased model classification accuracy and inaccurate classification caused by the imbalance of distribution network data samples by constructing a CNN-LSTM distribution network attack classification method based on the channel attention mechanism, thereby better eliminating the impact of small-category attack samples of the distribution network on the operation of the distribution network.

[0063] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0064] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0065] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. A method for classifying network attacks on distribution networks, characterized in that: The following steps are involved: The NSL-KDD dataset is preprocessed based on the state perception information of the distribution network; Building a convolutional neural network (CNN)-long short-term memory (LSTM) distribution network attack classification model based on a channel attention mechanism. The CNN-LSTM distribution network attack classification model based on a channel attention mechanism adopts a serial form and includes an input layer, a two-dimensional convolutional layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory (LSTM) network layer, a tiling layer, a fully connected layer, and an overfitting layer. Perform feature fusion on the CNN-LSTM distribution network attack classification model based on the channel attention mechanism, use the NSL-KDD dataset to train the CNN-LSTM distribution network attack classification model based on the channel attention mechanism, verify the classification accuracy of the CNN-LSTM distribution network attack classification model based on the channel attention mechanism, and output the network attack classification result for the distribution network through the Softmax function; The construction of a convolutional neural network (CNN)-long short-term memory (LSTM) distribution network attack classification model based on a channel attention mechanism specifically includes: Use convolutional neural networks to perform two-dimensional convolution on the data collected in the distribution network, converting the one-dimensional space into a two-dimensional space; The long short-term memory network is used to extract bidirectional temporal features of the data collected from the distribution network. A channel attention mechanism is introduced to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data. According to the characteristics of the distribution network network attack classification model, the dimension of the input data is converted into a tensor of (114, 1) and then sent to the input layer; the tensor is subjected to two-dimensional convolutional spatial feature extraction, and the channel attention mechanism is introduced to enhance the key features of the sample data; the data is reconstructed to obtain a dimension that can be input into the long short-term memory network; the long short-term memory network layer is used to perform bidirectional extraction of the temporal features of the data in the distribution network, and the flattening layer is used to flatten the data into a one-dimensional feature vector; a fully connected layer is used to complete feature recognition, and an overfitting layer is added for regularization. The fully connected layer uses the Softmax function and has 5 neurons.

2. The method according to claim 1, characterized in that The preprocessing of the NSL-KDD dataset based on the state perception information of the distribution network specifically includes: According to the state perception information of the distribution network, the NSL-KDD dataset is classified and a mapping dictionary is established. Feature encoding, data merging and feature normalization are performed on the discrete features in the data features, and adaptive comprehensive oversampling technology is used to increase the small sample set of network attacks.

3. The method according to claim 1, characterized in that There are three character-type discrete features in the NSL-KDD dataset: "protocol_type", "service" and "flag".

4. A network attack classification system for distribution networks, characterized in that: include: The preprocessing module is used to preprocess the NSL-KDD dataset based on the state perception information of the distribution network; A module is built to build a convolutional neural network (CNN)-long short-term memory (LSTM) distribution network attack classification model based on a channel attention mechanism. The CNN-LSTM distribution network attack classification model based on a channel attention mechanism adopts a serial form, including an input layer, a two-dimensional convolutional layer, a channel attention mechanism layer, a reshaping layer, a long short-term memory network layer, a tiling layer, a fully connected layer, and an overfitting layer; specifically, it includes: Use convolutional neural networks to perform two-dimensional convolution on the data collected in the distribution network, converting the one-dimensional space into a two-dimensional space; The long short-term memory network is used to extract bidirectional temporal features of the data collected from the distribution network. A channel attention mechanism is introduced to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data. Based on the characteristics of the distribution network attack classification model, the input data is converted into a tensor of (114, 1) and then sent to the input layer. The tensor is subjected to two-dimensional convolution spatial feature extraction, and a channel attention mechanism is introduced to enhance the key features of the sample data. The data is reconstructed to obtain a dimension that can be input into a long short-term memory network. The long short-term memory network layer is used to extract bidirectional temporal features of data in the distribution network, and the flattening layer is used to flatten the data into a one-dimensional feature vector. A fully connected layer is used to complete feature recognition, and an overfitting layer is added for regularization. The fully connected layer uses the Softmax function and has 5 neurons. A classification module is used to perform feature fusion on the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, train the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism using the NSL-KDD dataset, verify the classification accuracy of the CNN-LSTM distribution network network attack classification model based on the channel attention mechanism, and output the network attack classification result for the distribution network through the Softmax function.

5. The system according to claim 4, characterized in that The preprocessing module is specifically used to classify the NSL-KDD data set according to the state perception information of the distribution network and establish a mapping dictionary, perform feature encoding, data merging and feature normalization on discrete features in the data features, and use adaptive comprehensive oversampling technology to increase the small sample set of network attacks.

6. The system according to claim 4, characterized in that The construction module is specifically used to use a convolutional neural network to perform two-dimensional convolution on the data collected in the distribution network, converting the one-dimensional space into a two-dimensional space; bidirectionally extracting the temporal features of the data collected from the distribution network through a long short-term memory network, and introducing a channel attention mechanism to enhance the key features of the data collected from the distribution network, thereby extracting local features of the data.

7. The system according to claim 4, wherein: The building module is specifically used to convert the dimension of the input data into a tensor of (114, 1) based on the characteristics of the distribution network network attack classification model, and then send it to the input layer; perform two-dimensional convolution spatial feature extraction on the tensor, and introduce a channel attention mechanism to enhance the key features of the sample data; The data is reconstructed to obtain dimensions that can be input into the long short-term memory network; the long short-term memory network layer is used to extract the bidirectional temporal features of the data in the distribution network, and the flattening layer is used to flatten the data into a one-dimensional feature vector; A fully connected layer is used to complete feature recognition, and an overfitting layer is added for regularization. The fully connected layer uses a Softmax function and has 5 neurons.

8. The system according to claim 4, wherein: There are three character-type discrete features in the NSL-KDD dataset: "protocol_type", "service" and "flag".

Images