Sample data generation method, model training method, and device fingerprint classification method

Abstract

A sample data generation method, a model training method, a device fingerprint classification method and device, the sample data generation method comprising: grabbing smart substation messages; analyzing the smart substation messages, and using the analyzed message fields, combining with the smart substation structure information stored in the SCD file, obtaining a device type label and updating a device label table; based on the updated device label table, obtaining a device type label value and a message feature field and encapsulating them as a PTD data set to serve as sample data of a smart substation measurement and control device fingerprint classification model. The model training using the sample data generated by the method provided in the embodiment of the application can improve the feature extraction effect and the generalization of the model, and thus the recognition and classification of the smart substation measurement and control device by the model can be realized.

Description

Technical Field

[0001] This invention relates to the field of smart grid information security technology, and more specifically, to a sample data generation method, a model training method, a device fingerprint classification method, and a device. Background Technology

[0002] With the development of smart grid informatization, the cybersecurity risks faced by power control systems are becoming increasingly prominent. As a crucial component of the smart grid, power control systems serve as both the physical foundation for providing services and a primary target for cyberattacks. In recent years, incidents of power equipment or grid failures caused by cyberattacks have been frequent, highlighting the urgent need for stronger security measures to improve the security of power control systems. Substation automation systems, as an important part of power control systems, utilize communication networks and intelligent terminals to automatically monitor, measure, control, and coordinate substations, and interact with multiple other systems, playing a vital role in the power system.

[0003] Device fingerprints refer to the unique characteristics or identifiers that can be used to uniquely identify a device. Currently, device fingerprints are widely used as an identification and authentication method for terminal devices on both PCs and mobile devices. Existing device fingerprint acquisition methods are mainly divided into two types: active and passive. Active fingerprint acquisition uses probe frames to obtain device information, while passive fingerprint acquisition extracts features from network traffic to achieve device identification. However, active device fingerprinting requires sending probe frames to the device, which is complex to deploy in power control systems and has certain bandwidth requirements, easily leading to excessive consumption of network resources for power control equipment. Furthermore, although there are currently several scanning tools with active fingerprinting capabilities, such as Zoomeye (combining device fingerprints and web application fingerprints) and Nmap (based on TCP / IP protocol stack fingerprints), these recognition engines and tools are not applicable to the power control field. Passive fingerprinting uses traffic data to generate fingerprint features, requiring analysis of traffic feature fields. Current research mainly focuses on the identification of wireless devices, with relatively little research on wired network-connected power control network equipment. A passive device fingerprinting method for intelligent substation monitoring and control equipment needs to be proposed. Summary of the Invention

[0004] In view of this, the present invention proposes a sample data generation method, a model training method, a device fingerprint classification method and apparatus, aiming to solve the problems of complex deployment, high bandwidth requirements and excessive consumption of network resources of power industrial control equipment in the existing device fingerprint acquisition methods, and to fill the gap in passive device fingerprint acquisition technology.

[0005] In a first aspect, embodiments of the present invention propose a sample data generation method, the method comprising: capturing smart substation messages; parsing the smart substation messages, and using the parsed message fields, combined with the smart substation structure information stored in the SCD file, obtaining equipment type tags and updating the equipment tag table; based on the updated equipment tag table, obtaining equipment type tag values ​​and message feature fields, and encapsulating the message feature fields and the equipment type tag values ​​into a PTD dataset as sample data for a fingerprint classification model of smart substation measurement and control equipment.

[0006] Furthermore, before parsing the smart substation message, the process includes: checking the content of the smart substation message.

[0007] Furthermore, the smart substation message is parsed, and the parsed message fields are used in conjunction with the smart substation structure information stored in the SCD file to obtain device type tags and update the device tag table. This includes: parsing the smart substation message to obtain the MAC address and APPID sequence number; searching the currently parsed APPID sequence number in the SCD file to obtain the device type information corresponding to the current message; and determining whether to update the current device tag table based on whether the device type information corresponding to the current message and the currently parsed MAC address exist in the current device tag table.

[0008] Furthermore, the method also includes: initializing a database table and creating a device tag table for storing tag information and device information.

[0009] Further, based on whether the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, it is determined whether to update the current device label table, including: if the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, then there is no need to update the current device label table; if the device type information corresponding to the current packet exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table; if the device type information corresponding to the current packet and the currently parsed MAC address do not exist in the current device label table, then... If the current device label table contains the corresponding device type information and is not empty, then a new row is added to the current device label table. The currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current packet, and the device type label is set to the maximum value of the current device type label + 1. If the current device label table is empty, then a new row is added to the current device label table. The currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current packet, and the device type label is set to 0.

[0010] Furthermore, obtaining the device type tag value and message feature field based on the updated device tag table includes: creating a new PTD file and filling in the header of the new PTD file based on the updated device tag table; obtaining the device type tag value using the parsed MAC address in the updated device tag table, and extracting the message feature field from the updated device tag table.

[0011] Secondly, embodiments of the present invention also provide a model training method, the method comprising: dividing sample data obtained by the methods provided in the above embodiments into a training set and a test set according to a preset ratio; training an initial neural network model using the training set to generate a fingerprint classification model for intelligent substation monitoring and control equipment; and performing a performance test on the currently trained fingerprint classification model for intelligent substation monitoring and control equipment using the test set: if the detection accuracy of the performance test reaches the target accuracy, then saving the currently trained fingerprint classification model for intelligent substation monitoring and control equipment; otherwise, adjusting the model parameters and returning to the model training step.

[0012] Furthermore, the initial neural network model was pre-built based on the TensorFlow framework.

[0013] Furthermore, the initial neural network model includes: an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a fully connected layer, and an output layer.

[0014] Furthermore, the convolution result of both the first and second convolutional layers is calculated using the following formula:

[0015]

[0016] Where, x i，j ω represents the elements in the convolution region M of the input X, m represents the kernel size, b represents the bias, and f(·) represents the ReLU activation function.

[0017] Furthermore, the expansion size of both the first and second convolutional layers can be calculated using the following formula:

[0018]

[0019] PT = (O-1) × step + mI;

[0020]

[0021] PR = PB = PT - PL;

[0022] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion size of the image, PR is the right expansion size of the image, PU is the top expansion size of the image, PB is the bottom expansion size of the image, ceil(·) is the floor function, and floor(·) is the floor function.

[0023] Furthermore, the output layer outputs the classification result through the Softmax function.

[0024] Thirdly, embodiments of the present invention also provide a device fingerprint classification method, the method comprising: capturing traffic data; processing and encapsulating the traffic data, and inputting it into a fingerprint classification model for intelligent substation monitoring and control equipment trained using the methods provided in the above embodiments for identification and classification; and outputting the identification and classification results.

[0025] Fourthly, embodiments of the present invention also provide a sample data generation device, the device comprising: a message capture unit for capturing messages from a smart substation; a first processing unit for parsing the smart substation messages and using the parsed message fields, combined with the smart substation structure information stored in an SCD file, to obtain equipment type tags and update the equipment tag table; and a second processing unit for obtaining equipment type tag values ​​and message feature fields based on the updated equipment tag table, and encapsulating the message feature fields and the equipment type tag values ​​into a PTD dataset as sample data for a fingerprint classification model of smart substation measurement and control equipment.

[0026] Furthermore, before parsing the smart substation message, the process includes: checking the content of the smart substation message.

[0027] Furthermore, the first processing unit is also configured to: parse the smart substation message to obtain the MAC address and APPID sequence number; search the currently parsed APPID sequence number in the SCD file to obtain the device type information corresponding to the current message; and determine whether to update the current device tag table based on whether the device type information corresponding to the current message and the currently parsed MAC address exist in the current device tag table.

[0028] Furthermore, the device also includes a device tag table creation unit for initializing a database table and creating a device tag table for storing tag information and device information.

[0029] Further, based on whether the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, it is determined whether to update the current device label table, including: if the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, then there is no need to update the current device label table; if the device type information corresponding to the current packet exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table; if the device type information corresponding to the current packet and the currently parsed MAC address do not exist in the current device label table, then... If the current device label table contains the corresponding device type information and is not empty, then a new row is added to the current device label table. The currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current packet, and the device type label is set to the maximum value of the current device type label + 1. If the current device label table is empty, then a new row is added to the current device label table. The currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current packet, and the device type label is set to 0.

[0030] Furthermore, obtaining the device type tag value and message feature field based on the updated device tag table includes: creating a new PTD file and filling in the header of the new PTD file based on the updated device tag table; obtaining the device type tag value using the parsed MAC address in the updated device tag table, and extracting the message feature field from the updated device tag table.

[0031] Fifthly, embodiments of the present invention also provide a model training apparatus, the apparatus comprising: a data partitioning unit, configured to partition sample data obtained by the methods provided in the above embodiments into a training set and a test set according to a preset ratio; a model training unit, configured to train an initial neural network model using the training set to generate a fingerprint classification model for intelligent substation monitoring and control equipment; and a model testing unit, configured to perform performance testing on the currently trained fingerprint classification model for intelligent substation monitoring and control equipment using the test set: if the detection accuracy of the performance test reaches the target accuracy, then the currently trained fingerprint classification model for intelligent substation monitoring and control equipment is saved; otherwise, the model parameters are adjusted, and the model training step is returned.

[0032] Furthermore, the initial neural network model was pre-built based on the TensorFlow framework.

[0033] Furthermore, the initial neural network model includes: an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a fully connected layer, and an output layer.

[0034] Furthermore, the convolution result of both the first and second convolutional layers is calculated using the following formula:

[0035]

[0036] Where, x i,j ω represents the elements in the convolution region M of the input X, m represents the kernel size, b represents the bias, and f(·) represents the ReLU activation function.

[0037] Furthermore, the expansion size of both the first and second convolutional layers can be calculated using the following formula:

[0038]

[0039] PT = (O-1) × step + mI;

[0040]

[0041] PR = PB = PT - PL;

[0042] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion size of the image, PR is the right expansion size of the image, PU is the top expansion size of the image, PB is the bottom expansion size of the image, ceil(·) is the floor function, and floor(·) is the floor function.

[0043] Furthermore, the output layer outputs the classification result through the Softmax function.

[0044] Sixthly, embodiments of the present invention also provide a device fingerprint classification apparatus, the apparatus comprising: a traffic capture unit for capturing traffic data; an identification and classification unit for processing and encapsulating the traffic data and inputting it into a fingerprint classification model for intelligent substation monitoring and control equipment trained using the methods provided in the above embodiments for identification and classification; and a result output unit for outputting the identification and classification results.

[0045] In a seventh aspect, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the sample data generation method, the model training method, or the device fingerprint classification method provided in the above embodiments.

[0046] Eighthly, embodiments of the present invention also provide an electronic device, including: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the sample data generation method provided in the above embodiments, or the model training method provided in the above embodiments, or the device fingerprint classification method provided in the above embodiments.

[0047] The sample data generation method and apparatus provided in this invention generate sample data for a fingerprint classification model of intelligent substation monitoring and control equipment by parsing, searching and matching, extracting and integrating, and re-encapsulating original intelligent substation messages. This provides reliable sample data for subsequent model training, thus solving the problem of missing samples during model training. Using the sample data generated by the method provided in this invention to train the model can improve the model's feature extraction performance and generalization ability, thereby enabling the model to identify and classify intelligent substation monitoring and control equipment.

[0048] The model training method, device fingerprint classification method, and apparatus provided in this invention construct an initial neural network model and train and test the model using training and testing sets respectively to obtain a final fingerprint classification model for intelligent substation measurement and control equipment. This solves the problems of complex deployment, high bandwidth requirements, and excessive consumption of network resources of power industrial control equipment in existing device fingerprint acquisition methods, and fills the gap in passive device fingerprint acquisition technology. Using the fingerprint classification model for intelligent substation measurement and control equipment provided in this invention, the identification and classification of intelligent substation measurement and control equipment can be realized, which helps to further carry out identity authentication, secure access, asset management, and other work, and improve the security of power industrial control systems. Attached Figure Description

[0049] Figure 1 An exemplary flowchart of a sample data generation method according to an embodiment of the present invention is shown;

[0050] Figure 2 A schematic diagram of a method for capturing flow in an intelligent substation according to an embodiment of the present invention is shown.

[0051] Figure 3 A schematic diagram of the structure of a PTD dataset according to an embodiment of the present invention is shown;

[0052] Figure 4 An exemplary flowchart of a model training method according to an embodiment of the present invention is shown;

[0053] Figure 5 A schematic diagram of the architecture of a neural network model for fingerprint classification of intelligent substation monitoring and control equipment is shown according to an embodiment of the present invention.

[0054] Figure 6a The figure shows a comparison of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention with commonly used RNN and LSTM models under the GOOSE protocol. Figure 6b A comparison chart of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention with commonly used RNN and LSTM models under the SV protocol is shown.

[0055] Figure 7 An exemplary flowchart of a device fingerprint classification method according to an embodiment of the present invention is shown;

[0056] Figure 8 A schematic diagram of the structure of a sample data generation apparatus according to an embodiment of the present invention is shown;

[0057] Figure 9 A schematic diagram of the structure of a model training apparatus according to an embodiment of the present invention is shown;

[0058] Figure 10 A schematic diagram of the structure of a device fingerprint classification device according to an embodiment of the present invention is shown. Detailed Implementation

[0059] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0060] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0061] Figure 1 An exemplary flowchart of a sample data generation method according to an embodiment of the present invention is shown.

[0062] like Figure 1 As shown, the method includes:

[0063] Step S101: Capture smart substation messages.

[0064] Figure 2A schematic diagram illustrating the process of a smart substation flow capture method according to an embodiment of the present invention is shown. Figure 2 As shown, a photoelectric converter is used to connect the monitoring computer to the process layer switch. After that, the monitoring computer can capture the GOOSE or SV network traffic in the process layer, thereby obtaining the GOOSE or SV protocol traffic in the smart substation. The captured traffic data will be saved as a Pcapng file for subsequent traffic preprocessing.

[0065] Step S102: Parse the smart substation message, and use the parsed message fields, combined with the smart substation structure information stored in the SCD file, to obtain the equipment type label and update the equipment label table.

[0066] Furthermore, before parsing the smart substation message, the following steps are included:

[0067] Check the content of the messages from the smart substation.

[0068] Check the accuracy of the GOOSE or SV protocol messages, delete malformed messages, and save the checked GOOSE or SV protocol messages as a Pcapng file.

[0069] Further, step S102 includes:

[0070] Parse the smart substation message to obtain the MAC address and APPID sequence number;

[0071] Search the SCD file for the currently parsed APPID sequence number to obtain the device type information corresponding to the current message;

[0072] Based on whether the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device tag table, determine whether to update the current device tag table.

[0073] By parsing GOOSE or SV protocol messages, the response content of specified fields in the message can be obtained. Specifically, in this embodiment of the invention, the fields of interest are the source MAC address field and the APPID field within the message. Parsing the smart substation message yields the source MAC address and the APPID sequence number. Using an SCD visualization tool to open the SCD file, the APPID field is used as an intermediate medium to obtain the device type information corresponding to the message. By searching for the currently parsed APPID sequence number, the device topology diagram corresponding to the current message can be obtained in the SCD visualization tool, thus revealing the device type information corresponding to the current message.

[0074] Furthermore, the method also includes:

[0075] Initialize the database tables and create a device tag table to store tag information and device information.

[0076] The device tag table includes the device MAC address, device type information, and tag data matching the device. The created device tag table contains fields including the device MAC address byte string, the device type string, and an unsigned integer tag corresponding to the device type, where the device type tag serves as the primary key of the device tag table. Since devices under the GOOSE protocol and devices under the SV protocol are fingerprinted separately in this embodiment of the invention, device tag tables with identical structures are created for both the GOOSE and SV protocols.

[0077] Furthermore, after parsing the smart substation message and obtaining the MAC address and APPID sequence number, the following is included:

[0078] Search for the MAC address in the MAC address byte string field of the current device tag table. If it exists, move to the next packet and return to the packet parsing step.

[0079] Furthermore, based on whether the device type information corresponding to the current packet exists in the current device tag table and the currently parsed MAC address, it is determined whether to update the current device tag table, including:

[0080] If the current device label table contains the device type information corresponding to the current packet and the currently parsed MAC address, then there is no need to update the current device label table;

[0081] If the device type information corresponding to the current packet exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table;

[0082] If the device type information corresponding to the current packet does not exist in the current device label table, and the current device label table is not empty, then add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to the maximum value of the current device type label + 1.

[0083] If the current device label table is empty, add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to 0.

[0084] Step S103: Based on the updated device label table, obtain the device type label value and message feature field, and encapsulate the message feature field and the device type label value into a PTD dataset as sample data for the fingerprint classification model of intelligent substation measurement and control equipment.

[0085] Furthermore, based on the updated device label table, the device type label value and message characteristic fields are obtained, including:

[0086] Create a new PTD file and, based on the updated device label table, complete the header of the new PTD file;

[0087] The device type label value is obtained by using the parsed MAC address in the updated device label table, and the packet feature field is extracted from the updated device label table.

[0088] Figure 3 A schematic diagram of the structure of a PTD dataset according to an embodiment of the present invention is shown. Figure 3 As shown, the PTD dataset encapsulation format encapsulates message data into the PTD file data section, while auxiliary information is encapsulated into the PTD file header. The auxiliary information includes the number of tag types, the number of message images, the message image length, and the message image width. The number of tag types corresponds to the maximum value of the matching tag for the device type in the device tag table plus 1. The number of message images is the number of messages in the current file. Both the message image length and width are set to 28.

[0089] For the GOOSE protocol, the message feature fields include the destination MAC address, source MAC address, APPID field, and the GoCBRef, DataSet, GoID, and AllData fields within the APDU field. For the SV protocol, the message feature fields include the destination MAC address, source MAC address, APPID field, and the ASDU string within the APDU field. By searching the updated device tag table for the message's source MAC address, the device tag value corresponding to that MAC address can be obtained. The message feature field data is standardized to a size of 28×28. If the message feature field data is too short, it is padded with 0x00 bytes; otherwise, the message feature field is truncated and encapsulated together with the device tag value into the PTD dataset.

[0090] The above embodiments generate sample data for a fingerprint classification model of intelligent substation monitoring and control equipment by parsing, searching and matching, extracting and integrating, and re-encapsulating the original intelligent substation messages. This provides reliable sample data for subsequent model training, thus solving the problem of missing samples during model training. Using the sample data generated by the method provided in this embodiment can improve the model's feature extraction performance and generalization ability, thereby enabling the model to identify and classify intelligent substation monitoring and control equipment.

[0091] Figure 4 An exemplary flowchart of a model training method according to an embodiment of the present invention is shown.

[0092] like Figure 4 As shown, the method includes:

[0093] Step S401: According to a preset ratio, the sample data obtained by the methods provided in the above embodiments are divided into a training set and a test set.

[0094] It can generate a total of 4 files, including the PTD training dataset and test dataset under the GOOSE and SV protocols.

[0095] Step S402: Train the initial neural network model using the training set to generate a fingerprint classification model for intelligent substation monitoring and control equipment.

[0096] Since byte values ​​can be mapped one-to-one with the grayscale value of a pixel in a grayscale image, this embodiment of the invention can be regarded as classifying grayscale images of message data. The grayscale image size is 28×28. The grayscale image features of the message are obtained using a neural network to classify the grayscale image, which is to classify the message data of the smart substation, thereby completing the fingerprint recognition of the smart substation measurement and control equipment.

[0097] The PTD training datasets corresponding to the GOOSE and SV protocols were respectively input into the initial neural network model for training and learning, generating fingerprint classification models for smart substation monitoring and control equipment of the two protocols.

[0098] Furthermore, the initial neural network model was pre-built based on the TensorFlow framework.

[0099] Furthermore, the initial neural network model includes: an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a fully connected layer, and an output layer.

[0100] Furthermore, the convolution results for both the first and second convolutional layers are calculated using the following formula:

[0101]

[0102] Where, x i，j ω represents the elements in the convolution region M of the input X, m represents the kernel size, b represents the bias, and f(·) represents the ReLU activation function.

[0103] Furthermore, the expansion size of both the first and second convolutional layers can be calculated using the following formula:

[0104]

[0105] PT = (O-1) × step + mI;

[0106]

[0107] PR = PB = PT - PL;

[0108] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion size of the image, PR is the right expansion size of the image, PU is the top expansion size of the image, PB is the bottom expansion size of the image, ceil(·) is the floor function, and floor(·) is the floor function.

[0109] Furthermore, the output layer outputs the classification results through the Softmax function.

[0110] Table 1. Parameter configuration of the neural network model used for fingerprint analysis of intelligent substation monitoring and control equipment.

[0111]

[0112]

[0113] Figure 5 Table 1 and Figure 2 respectively show the architecture diagram and parameter configuration of a neural network model for fingerprint classification of intelligent substation monitoring and control equipment according to an embodiment of the present invention. Figure 5 As shown in Table 1, the model consists of seven layers, including the input layer, as follows:

[0114] First layer (input layer): The input data is a 28×28 grayscale image of the message and the device type label value that matches the message.

[0115] The second layer (first convolutional layer): The first convolutional layer is used to extract grayscale image features of the message. The kernel size is set to 5×5, and the convolution result is calculated using the following formula:

[0116]

[0117] Where x represents an element in the convolution region M of the input X, ω represents an element in the convolution kernel, m represents the size of the convolution kernel, b represents the bias, and f(·) represents the ReLU activation function, as shown in the formula below:

[0118]

[0119] To ensure the stability of the input and output dimensions of the convolutional layer, a zero-expansion operation is performed on the input. The expansion size for zero expansion can be calculated using the following formula:

[0120]

[0121] PT = (O-1) × step + mI;

[0122]

[0123] PR = PB = PT - PL;

[0124] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion dimension, PR is the right expansion dimension, PU is the top expansion dimension, PB is the bottom expansion dimension, ceil(·) represents the floor function, and floor(·) represents the floor function. Calculations show that in the actual training of the model of this invention, the input size of the second convolutional layer will be expanded to 32×32, and the input size of the fourth convolutional layer will be expanded to 18×18.

[0125] The third layer (first pooling layer): The first pooling layer simplifies network complexity, compresses network size, and reduces training parameters. Max pooling is used here to retain the maximum value in the pooling region, and the pooling window size is set to 2×2.

[0126] The fourth layer (second convolutional layer): Similar to the second layer, it extracts features from the input data again;

[0127] Fifth layer (second pooling layer): Similar to the third layer, the input data is downsampled again to reduce the number of training parameters.

[0128] The sixth layer (fully connected layer): The feature information is compressed into a one-dimensional vector form through the fully connected layer.

[0129] Layer 7 (Output Layer): The output layer is fully connected to the sixth layer again, and the final output of the device fingerprint classification result is obtained through the Softmax function. The formula for the Softmax function is shown below:

[0130]

[0131] The probability of the input being classified as category j is calculated, where N represents the number of device types that need to be classified in this invention, and the maximum value in the output result vector is the classification result.

[0132] Step S403: Use the test set to perform performance testing on the currently trained fingerprint classification model of intelligent substation measurement and control equipment: If the detection accuracy of the performance test reaches the target accuracy, save the currently trained fingerprint classification model of intelligent substation measurement and control equipment; otherwise, adjust the model parameters and return to the model training step.

[0133] Figure 6a The figure shows a comparison of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention with commonly used RNN and LSTM models under the GOOSE protocol. Figure 6b This diagram illustrates a comparison of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention, compared with commonly used RNN and LSTM models, under the SV protocol. Accuracy represents the proportion of correctly classified samples out of the total samples; F1 represents the F1 score, the harmonic mean of precision and recall. Figure 6a and Figure 6b As shown, for GOOSE protocol devices and SV protocol devices, the fingerprint classification CNN model for intelligent substation monitoring and control equipment based on flow characteristics proposed in this embodiment of the invention achieves higher classification accuracy and F1 score compared to RNN and LSTM models, which are also commonly used in the field of flow classification, thus achieving better classification results.

[0134] The above embodiments, by constructing an initial neural network model and training and testing the model using training and testing sets respectively, obtain the final fingerprint classification model for intelligent substation measurement and control equipment. This solves the problems of complex deployment, high bandwidth requirements, and excessive consumption of network resources of power industrial control equipment in existing equipment fingerprint acquisition methods, and fills the gap in passive equipment fingerprint acquisition technology. Using the fingerprint classification model for intelligent substation measurement and control equipment provided by the embodiments of the present invention, the identification and classification of intelligent substation measurement and control equipment can be realized, which helps to further carry out identity authentication, secure access, asset management and other work, and improve the security of power industrial control system.

[0135] Figure 7 An exemplary flowchart of a device fingerprint classification method according to an embodiment of the present invention is shown.

[0136] like Figure 7 As shown, the method includes:

[0137] Step S701: Capture traffic data;

[0138] Step S702: After processing and encapsulating the traffic data, input it into the fingerprint classification model of the intelligent substation monitoring and control equipment trained using the methods provided in the above embodiments for identification and classification;

[0139] Step S703: Output the recognition and classification results.

[0140] Traffic data captured in the experimental environment is used as the test sample. The traffic data is processed and encapsulated by a Python program. The packet data is input into the corresponding classification model for detection. The given label data is searched in the device type and matching label table to obtain the device type information corresponding to the label.

[0141] The above embodiments solve the problems of complex deployment, high bandwidth requirements, and excessive consumption of network resources of power industrial control equipment in the existing technology of equipment fingerprint acquisition methods by inputting the captured traffic data into the fingerprint classification model of intelligent substation measurement and control equipment for identification and classification. It fills the gap in passive equipment fingerprint acquisition technology, realizes the identification and classification of intelligent substation measurement and control equipment, and helps to further carry out identity authentication, secure access, asset management and other work, thereby improving the security of power industrial control system.

[0142] Figure 8 A schematic diagram of a sample data generation apparatus according to an embodiment of the present invention is shown.

[0143] like Figure 8 As shown, the device includes:

[0144] The message capture unit 801 is used to capture messages from smart substations.

[0145] Figure 2 A schematic diagram illustrating the process of a smart substation flow capture method according to an embodiment of the present invention is shown. Figure 2 As shown, a photoelectric converter is used to connect the monitoring computer to the process layer switch. After that, the monitoring computer can capture the GOOSE or SV network traffic in the process layer, thereby obtaining the GOOSE or SV protocol traffic in the smart substation. The captured traffic data will be saved as a Pcapng file for subsequent traffic preprocessing.

[0146] The first processing unit 802 is used to parse the smart substation message, and use the parsed message fields, combined with the smart substation structure information stored in the SCD file, to obtain the equipment type label and update the equipment label table.

[0147] Furthermore, before parsing the smart substation message, the following steps are included:

[0148] Check the content of the messages from the smart substation.

[0149] Check the accuracy of the GOOSE or SV protocol messages, delete malformed messages, and save the checked GOOSE or SV protocol messages as a Pcapng file.

[0150] Furthermore, the first processing unit 802 is also used for:

[0151] Parse the smart substation message to obtain the MAC address and APPID sequence number;

[0152] Search the SCD file for the currently parsed APPID sequence number to obtain the device type information corresponding to the current message;

[0153] Based on whether the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device tag table, determine whether to update the current device tag table.

[0154] By parsing GOOSE or SV protocol messages, the response content of specified fields in the message can be obtained. Specifically, in this embodiment of the invention, the fields of interest are the source MAC address field and the APPID field within the message. Parsing the smart substation message yields the source MAC address and the APPID sequence number. Using an SCD visualization tool to open the SCD file, the APPID field is used as an intermediate medium to obtain the device type information corresponding to the message. By searching for the currently parsed APPID sequence number, the device topology diagram corresponding to the current message can be obtained in the SCD visualization tool, thus revealing the device type information corresponding to the current message.

[0155] Furthermore, the device also includes:

[0156] The device tag table creation unit is used to initialize the database table and create a device tag table for storing tag information and device information.

[0157] The device tag table includes the device MAC address, device type information, and tag data matching the device. The created device tag table contains fields including the device MAC address byte string, the device type string, and an unsigned integer tag corresponding to the device type, where the device type tag serves as the primary key of the device tag table. Since devices under the GOOSE protocol and devices under the SV protocol are fingerprinted separately in this embodiment of the invention, device tag tables with identical structures are created for both the GOOSE and SV protocols.

[0158] Furthermore, after parsing the smart substation message and obtaining the MAC address and APPID sequence number, the following is included:

[0159] Search for the MAC address in the MAC address byte string field of the current device tag table. If it exists, move to the next packet and return to the packet parsing step.

[0160] Furthermore, based on whether the device type information corresponding to the current packet exists in the current device tag table and the currently parsed MAC address, it is determined whether to update the current device tag table, including:

[0161] If the current device label table contains the device type information corresponding to the current packet and the currently parsed MAC address, then there is no need to update the current device label table;

[0162] If the device type information corresponding to the current packet exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table;

[0163] If the device type information corresponding to the current packet does not exist in the current device label table, and the current device label table is not empty, then add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to the maximum value of the current device type label + 1.

[0164] If the current device label table is empty, add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to 0.

[0165] The second processing unit 803 is used to obtain the device type label value and the message feature field based on the updated device label table, and to encapsulate the message feature field and the device type label value into a PTD dataset as sample data for the fingerprint classification model of intelligent substation measurement and control equipment.

[0166] Furthermore, based on the updated device label table, the device type label value and message characteristic fields are obtained, including:

[0167] Create a new PTD file and, based on the updated device label table, complete the header of the new PTD file;

[0168] The device type label value is obtained by using the parsed MAC address in the updated device label table, and the packet feature field is extracted from the updated device label table.

[0169] Figure 3A schematic diagram of the structure of a PTD dataset according to an embodiment of the present invention is shown. Figure 3 As shown, the PTD dataset encapsulation format encapsulates message data into the PTD file data section, while auxiliary information is encapsulated into the PTD file header. The auxiliary information includes the number of tag types, the number of message images, the message image length, and the message image width. The number of tag types corresponds to the maximum value of the matching tag for the device type in the device tag table plus 1. The number of message images is the number of messages in the current file. Both the message image length and width are set to 28.

[0170] For the GOOSE protocol, the message feature fields include the destination MAC address, source MAC address, APPID field, and the GoCBRef, DataSet, GoID, and AllData fields within the APDU field. For the SV protocol, the message feature fields include the destination MAC address, source MAC address, APPID field, and the ASDU string within the APDU field. By searching the updated device tag table for the message's source MAC address, the device tag value corresponding to that MAC address can be obtained. The message feature field data is standardized to a size of 28×28. If the message feature field data is too short, it is padded with 0x00 bytes; otherwise, the message feature field is truncated and encapsulated together with the device tag value into the PTD dataset.

[0171] The above embodiments generate sample data for a fingerprint classification model of intelligent substation monitoring and control equipment by parsing, searching and matching, extracting and integrating, and re-encapsulating the original intelligent substation messages. This provides reliable sample data for subsequent model training, thus solving the problem of missing samples during model training. Using the sample data generated by the method provided in this embodiment can improve the model's feature extraction performance and generalization ability, thereby enabling the model to identify and classify intelligent substation monitoring and control equipment.

[0172] Figure 9 A schematic diagram of the structure of a model training device according to an embodiment of the present invention is shown.

[0173] like Figure 9 As shown, the device includes:

[0174] The data partitioning unit 901 is used to divide the sample data obtained by the methods provided in the above embodiments into a training set and a test set according to a preset ratio.

[0175] It can generate a total of 4 files, including the PTD training dataset and test dataset under the GOOSE and SV protocols.

[0176] The model training unit 902 is used to train the initial neural network model using the training set to generate a fingerprint classification model for intelligent substation measurement and control equipment.

[0177] Since byte values ​​can be mapped one-to-one with the grayscale value of a pixel in a grayscale image, this embodiment of the invention can be regarded as classifying grayscale images of message data. The grayscale image size is 28×28. The grayscale image features of the message are obtained using a neural network to classify the grayscale image, which is to classify the message data of the smart substation, thereby completing the fingerprint recognition of the smart substation measurement and control equipment.

[0178] The PTD training datasets corresponding to the GOOSE and SV protocols were respectively input into the initial neural network model for training and learning, generating fingerprint classification models for smart substation monitoring and control equipment of the two protocols.

[0179] Furthermore, the initial neural network model was pre-built based on the TensorFlow framework.

[0180] Furthermore, the initial neural network model includes: an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a fully connected layer, and an output layer.

[0181] Furthermore, the convolution results for both the first and second convolutional layers are calculated using the following formula:

[0182]

[0183] Where, x i，j ω represents the elements in the convolution region M of the input X, m represents the kernel size, b represents the bias, and f(·) represents the ReLU activation function.

[0184] Furthermore, the expansion size of both the first and second convolutional layers can be calculated using the following formula:

[0185]

[0186] PT = (O-1) × step + mI;

[0187]

[0188] PR = PB = PT - PL;

[0189] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion size of the image, PR is the right expansion size of the image, PU is the top expansion size of the image, PB is the bottom expansion size of the image, ceil(·) is the floor function, and floor(·) is the floor function.

[0190] Furthermore, the output layer outputs the classification results through the Sofimax function.

[0191] Table 2 shows the parameter configuration for the neural network model used for fingerprint analysis of intelligent substation monitoring and control equipment.

[0192]

[0193] Figure 5 Tables 1 and 2 respectively show the architecture diagram and parameter configuration of a neural network model for fingerprint classification of intelligent substation monitoring and control equipment according to an embodiment of the present invention. Figure 5 As shown in Table 1, the model consists of seven layers, including the input layer, as follows:

[0194] First layer (input layer): The input data is a 28×28 grayscale image of the message and the device type label value that matches the message.

[0195] The second layer (first convolutional layer): The first convolutional layer is used to extract grayscale image features of the message. The kernel size is set to 5×5, and the convolution result is calculated using the following formula:

[0196]

[0197] Where x represents an element in the convolution region M of the input X, ω represents an element in the convolution kernel, m represents the size of the convolution kernel, b represents the bias, and f(·) represents the ReLU activation function, as shown in the formula below:

[0198]

[0199] To ensure the stability of the input and output dimensions of the convolutional layer, a zero-expansion operation is performed on the input. The expansion size for zero expansion can be calculated using the following formula:

[0200]

[0201] PT = (O-1) × step + mI;

[0202]

[0203] PR = PB = PT - PL;

[0204] Where I is the input image size, O is the output image size, m is the convolution kernel size, step is the stride, PL is the left expansion dimension, PR is the right expansion dimension, PU is the top expansion dimension, PB is the bottom expansion dimension, ceil(·) represents the floor function, and floor(·) represents the floor function. Calculations show that in the actual training of the model of this invention, the input size of the second convolutional layer will be expanded to 32×32, and the input size of the fourth convolutional layer will be expanded to 18×18.

[0205] The third layer (first pooling layer): The first pooling layer simplifies network complexity, compresses network size, and reduces training parameters. Max pooling is used here to retain the maximum value in the pooling region, and the pooling window size is set to 2×2.

[0206] The fourth layer (second convolutional layer): Similar to the second layer, it extracts features from the input data again;

[0207] Fifth layer (second pooling layer): Similar to the third layer, the input data is downsampled again to reduce the number of training parameters.

[0208] The sixth layer (fully connected layer): The feature information is compressed into a one-dimensional vector form through the fully connected layer.

[0209] Layer 7 (Output Layer): The output layer is fully connected to the sixth layer again, and the final output of the device fingerprint classification result is obtained through the Softmax function. The formula for the Softmax function is shown below:

[0210]

[0211] The probability of the input being classified as category j is calculated, where N represents the number of device types that need to be classified in this invention, and the maximum value in the output result vector is the classification result.

[0212] Model testing unit 903 is used to perform performance testing on the currently trained fingerprint classification model of intelligent substation measurement and control equipment using a test set: if the detection accuracy of the performance test reaches the target accuracy, the currently trained fingerprint classification model of intelligent substation measurement and control equipment is saved; otherwise, the model parameters are adjusted and the model training step is returned.

[0213] Figure 6a The figure shows a comparison of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention with commonly used RNN and LSTM models under the GOOSE protocol. Figure 6bThis diagram illustrates a comparison of the accuracy and F1 score of a fingerprint classification CNN model for intelligent substation monitoring and control equipment according to an embodiment of the present invention, compared with commonly used RNN and LSTM models, under the SV protocol. Accuracy represents the proportion of correctly classified samples out of the total samples; F1 represents the F1 score, the harmonic mean of precision and recall. Figure 6a and Figure 6b As shown, for GOOSE protocol devices and SV protocol devices, the fingerprint classification CNN model for intelligent substation monitoring and control equipment based on flow characteristics proposed in this embodiment of the invention achieves higher classification accuracy and F1 score compared to RNN and LSTM models, which are also commonly used in the field of flow classification, thus achieving better classification results.

[0214] The above embodiments, by constructing an initial neural network model and training and testing the model using training and testing sets respectively, obtain the final fingerprint classification model for intelligent substation measurement and control equipment. This solves the problems of complex deployment, high bandwidth requirements, and excessive consumption of network resources of power industrial control equipment in existing equipment fingerprint acquisition methods, and fills the gap in passive equipment fingerprint acquisition technology. Using the fingerprint classification model for intelligent substation measurement and control equipment provided by the embodiments of the present invention, the identification and classification of intelligent substation measurement and control equipment can be realized, which helps to further carry out identity authentication, secure access, asset management and other work, and improve the security of power industrial control system.

[0215] Figure 10 A schematic diagram of the structure of a device fingerprint classification device according to an embodiment of the present invention is shown.

[0216] like Figure 10 As shown, the device includes:

[0217] Traffic capture unit 1001 is used to capture traffic data;

[0218] The identification and classification unit 1002 is used to process and encapsulate the traffic data, and then input it into the fingerprint classification model of the intelligent substation measurement and control equipment trained by the methods provided in the above embodiments for identification and classification.

[0219] The result output unit 1003 is used to output the recognition and classification results.

[0220] Traffic data captured in the experimental environment is used as the test sample. The traffic data is processed and encapsulated by a Python program. The packet data is input into the corresponding classification model for detection. The given label data is searched in the device type and matching label table to obtain the device type information corresponding to the label.

[0221] The above embodiments solve the problems of complex deployment, high bandwidth requirements, and excessive consumption of network resources of power industrial control equipment in the existing technology of equipment fingerprint acquisition methods by inputting the captured traffic data into the fingerprint classification model of intelligent substation measurement and control equipment for identification and classification. It fills the gap in passive equipment fingerprint acquisition technology, realizes the identification and classification of intelligent substation measurement and control equipment, and helps to further carry out identity authentication, secure access, asset management and other work, thereby improving the security of power industrial control system.

[0222] This invention also provides a computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the sample data generation method, the model training method, or the device fingerprint classification method provided in the above embodiments.

[0223] This invention also provides an electronic device, including: a processor; a memory for storing processor-executable instructions; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the sample data generation method, the model training method, or the device fingerprint classification method provided in the above embodiments.

[0224] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0225] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the art, unless otherwise expressly defined herein. All references to “a / the / the [device, component, etc.]” ​​are openly interpreted as at least one instance of said device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed unless explicitly stated otherwise.

[0226] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0227] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0228] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0229] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0230] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for generating sample data, characterized in that, The method includes: Capture messages from smart substations; The smart substation message is parsed, and the parsed message fields are combined with the smart substation structure information stored in the SCD file to obtain the equipment type label and update the equipment label table. Based on the updated device label table, the device type label value and message feature field are obtained, and the message feature field and the device type label value are encapsulated into a PTD dataset as sample data for the fingerprint classification model of intelligent substation measurement and control equipment; This includes parsing the smart substation messages and using the parsed message fields, combined with the smart substation structure information stored in the SCD file, to obtain equipment type tags and update the equipment tag table, including: Parse the smart substation message to obtain the MAC address and APPID sequence number; Search the SCD file for the currently parsed APPID sequence number to obtain the device type information corresponding to the current message; If the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, then there is no need to update the current device label table; If the device type information corresponding to the current message exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table; If the device type information corresponding to the current message does not exist in the current device label table, and the current device label table is not empty, then a new row is added to the current device label table, the currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current message, and the device type label is set to the maximum value of the current device type label + 1. If the current device label table is empty, add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to 0.

2. The method according to claim 1, characterized in that, Before parsing the smart substation message, the following steps are included: The content of the smart substation message is checked.

3. The method according to claim 1, characterized in that, The method further includes: Initialize the database tables and create a device tag table to store tag information and device information.

4. The method according to claim 1, characterized in that, The updated device tag table yields device type tag values ​​and message characteristic fields, including: Create a new PTD file and, based on the updated device label table, complete the header of the new PTD file; The device type tag value is obtained by using the parsed MAC address in the updated device tag table, and the message feature field is extracted from the updated device tag table.

5. A model training method, characterized in that, The method includes: According to a preset ratio, the sample data obtained by any of the methods described in claims 1-4 will be divided into a training set and a test set; The initial neural network model is trained using the training set to generate a fingerprint classification model for intelligent substation monitoring and control equipment. The test set is used to perform performance testing on the fingerprint classification model of the intelligent substation measurement and control equipment that has been trained. If the detection accuracy of the performance test reaches the target accuracy, the fingerprint classification model of the intelligent substation measurement and control equipment that has been trained is saved; otherwise, the model parameters are adjusted and the model training step is returned.

6. The method according to claim 5, characterized in that, The initial neural network model was pre-built based on the TensorFlow framework.

7. The method according to claim 5, characterized in that, The initial neural network model includes: an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a fully connected layer, and an output layer.

8. The method according to claim 7, characterized in that, The convolution results for both the first and second convolutional layers are calculated using the following formula: ； in, x i,j For input X Medium convolution region M The elements in ω For elements in the convolution kernel, m The kernel size is [size]. b For bias, It is the ReLU activation function; Furthermore, the expansion size of both the first and second convolutional layers can be calculated using the following formula: ； ； ； ； in, I Input image size, O To output image size, m The kernel size is [size]. step Step size, PL Expand the size to the left of the image. PR Expand the size to the right of the image. PU Expand the size at the top of the image. PB Expand the size at the bottom of the image. It is a rounding function. This is the floor function.

9. The method according to claim 7, characterized in that, The output layer passes through Softmax The function outputs the classification results.

10. A device fingerprint classification method, characterized in that, The method includes: Capture traffic data; After the traffic data is processed and encapsulated, it is input into the fingerprint classification model of intelligent substation monitoring and control equipment trained by the method described in any one of claims 5-9 for identification and classification; Output the recognition and classification results.

11. A sample data generation device, characterized in that, The device includes: The message capture unit is used to capture messages from intelligent substations; The first processing unit is used to parse the smart substation message, and use the parsed message fields, combined with the smart substation structure information stored in the SCD file, to obtain the equipment type label and update the equipment label table. The second processing unit is used to obtain the device type label value and message feature field based on the updated device label table, and encapsulate the message feature field and the device type label value into a PTD dataset as sample data for the fingerprint classification model of intelligent substation measurement and control equipment. The first processing unit is further configured to: Parse the smart substation message to obtain the MAC address and APPID sequence number; Search the SCD file for the currently parsed APPID sequence number to obtain the device type information corresponding to the current message; If the device type information corresponding to the current packet and the currently parsed MAC address exist in the current device label table, then there is no need to update the current device label table; If the device type information corresponding to the current message exists in the current device label table, but the currently parsed MAC address does not exist, then the currently parsed MAC address is stored in the MAC address byte string field of the current device label table to update the current device label table; If the device type information corresponding to the current message does not exist in the current device label table, and the current device label table is not empty, then a new row is added to the current device label table, the currently parsed MAC address is added to the MAC address byte string field of the new row, the device type string field of the new row is set to the device type information corresponding to the current message, and the device type label is set to the maximum value of the current device type label + 1. If the current device label table is empty, add a new row to the current device label table, add the currently parsed MAC address to the MAC address byte string field of the new row, set the device type string field of the new row to the device type information corresponding to the current packet, and set the device type label to 0.

12. The apparatus according to claim 11, characterized in that, The updated device tag table yields device type tag values ​​and message characteristic fields, including: Create a new PTD file and, based on the updated device label table, complete the header of the new PTD file; The device type tag value is obtained by using the parsed MAC address in the updated device tag table, and the message feature field is extracted from the updated device tag table.

13. A model training device, characterized in that, The device includes: A data partitioning unit is used to divide the sample data obtained by any of the methods described in claims 1-4 into a training set and a test set according to a preset ratio; The model training unit is used to train the initial neural network model using the training set to generate a fingerprint classification model for intelligent substation monitoring and control equipment. The model testing unit is used to perform performance testing on the currently trained fingerprint classification model of intelligent substation measurement and control equipment using the test set: if the detection accuracy of the performance test reaches the target accuracy, the currently trained fingerprint classification model of intelligent substation measurement and control equipment is saved; otherwise, the model parameters are adjusted and the model training step is returned.

14. A device fingerprint classification apparatus, characterized in that, The device includes: The traffic capture unit is used to capture traffic data; The identification and classification unit is used to process and encapsulate the traffic data, and then input it into the fingerprint classification model of the intelligent substation measurement and control equipment trained by the method described in any one of claims 5-9 for identification and classification. The result output unit is used to output the recognition and classification results.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the sample data generation method of any one of claims 1-4, the model training method of any one of claims 5-9, or the device fingerprint classification method of claim 10.

16. An electronic device comprising: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the sample data generation method of any one of claims 1-4, the model training method of any one of claims 5-9, or the device fingerprint classification method of claim 10.

Images