A method, device and storage medium for intrusion detection in a power industrial control system

Abstract

This invention discloses an intrusion detection method, device, and storage medium for a power industrial control system. The method includes: acquiring power industrial control system data; classifying the power industrial control system data using a pre-trained random forest classification model; determining the classification result of the power industrial control system data; wherein the classification result is used to indicate whether intrusion behavior exists in the power industrial control system; and the random forest classification model is optimized according to the importance order of hyperparameters using a grid search hyperparameter optimization method.

Description

Technical Field

[0001] This invention relates to the field of power industrial control system technology, and more specifically, to a method, apparatus and storage medium for intrusion detection in power industrial control systems. Background Technology

[0002] The goals and architecture of power industrial control systems differ fundamentally from traditional information technology systems. Specifically, they involve: 1) processing real equipment; 2) a wide variety of equipment; 3) fixed business processes; 4) a primary objective of ensuring stable system operation; and 5) numerous proprietary protocols. Directly applying traditional network intrusion detection methods to power industrial control system intrusion detection results in poor detection effectiveness and fails to effectively address the characteristics of power industrial control systems. Therefore, intrusion detection technologies from traditional information systems cannot be directly applied.

[0003] Currently, there are three main types of intrusion detection technologies for power control systems: misuse detection, anomaly detection, and hybrid detection. Misuse detection identifies known attacks by extracting the characteristics of past attacks. However, this method cannot identify new attacks such as zero-day attacks, and administrators need to frequently update the feature rule database, which is unsuitable for power control systems requiring long-term stable operation. Anomaly detection first learns normal network and system behavior, then identifies anomalies by calculating the deviation between actual operation and normal behavior. The drawback of this method is a high false alarm rate, while power control systems require high accuracy to ensure stable operation. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an intrusion detection method, device, and storage medium for power industrial control systems.

[0005] According to one aspect of the present invention, an intrusion detection method for a power industrial control system is provided, comprising:

[0006] Acquire power control system data;

[0007] A pre-trained random forest classification model is used to classify power control system data and determine the classification results. The classification results are used to indicate whether there is intrusion behavior in the power control system. The random forest classification model is optimized according to the importance order of hyperparameters using a grid search hyperparameter optimization method.

[0008] Optionally, it also includes: preprocessing the power control system data, and

[0009] Preprocessing operations for power control system data include:

[0010] Delete data with missing values ​​from the power control system data;

[0011] Set the inf value in the power industrial control system data to 1000;

[0012] The power industrial control system data is standardized using pre-set standardized formulas;

[0013] The power control system data is normalized using a pre-set normalization method.

[0014] Alternatively, a random forest classification model can be trained using the following method:

[0015] Obtain historical power industrial control system datasets;

[0016] The first preset percentage of the historical power industrial control system dataset is used as the training dataset, and the second preset percentage of the historical power industrial control system dataset is used as the test dataset.

[0017] Constructing the hyperparameter configuration space for a random forest classification model;

[0018] A random forest classifier is constructed using combinations of hyperparameters in the hyperparameter configuration space.

[0019] Train a random forest classifier using the training dataset;

[0020] The random forest classification model is determined based on the combination of hyperparameters and the random forest classifier.

[0021] Optionally, it also includes: preprocessing historical power industrial control system datasets, and

[0022] The preprocessing operations for historical power control system datasets include:

[0023] Remove data with missing values ​​from the historical power industrial control system dataset;

[0024] Set the inf value in the historical power industrial control system dataset to 1000;

[0025] The historical power industrial control system dataset is standardized using a pre-set standardization formula;

[0026] The historical power industrial control system dataset is normalized using a pre-defined normalization method.

[0027] Optionally, it also includes:

[0028] The test dataset was classified using a random forest classifier, and the evaluation metrics for the random forest classifier were determined.

[0029] If the evaluation metrics exceed the pre-set evaluation threshold, the random forest classifier is deemed unqualified.

[0030] Optionally, it also includes:

[0031] The roc_auc score is used as the evaluation criterion.

[0032] Optionally, it also includes:

[0033] The importance ranking of hyperparameters in the hyperparameter combination is obtained through a pre-defined functional variance analysis.

[0034] Based on the order of importance of hyperparameters in the hyperparameter combination, grid search optimization is performed on each hyperparameter in turn to determine the optimal hyperparameter combination.

[0035] Replace the hyperparameter combination in the random forest classifier with the optimal hyperparameter combination to determine the optimal random forest classifier;

[0036] The random forest classification model is determined based on the optimal random forest classifier.

[0037] Optionally, the operation of obtaining the order of importance of hyperparameters in a combination of hyperparameters through a pre-defined functional variance analysis includes:

[0038] Functional variance analysis is used to decompose the variance of the predictions of each tree in the random forest classifier into the sum of the variance contributions of multiple hyperparameters.

[0039] The importance ranking of hyperparameters in a hyperparameter combination is determined based on the variance contribution values ​​of multiple hyperparameters in the combination.

[0040] According to another aspect of the present invention, an intrusion detection device for a power industrial control system is provided, comprising:

[0041] The first acquisition module is used to acquire power control system data from the power control system.

[0042] The first determination module is used to classify the power control system data using a pre-trained random forest classification model and determine the classification result of the power control system data. The classification result is used to indicate whether there is intrusion behavior in the power control system. The random forest classification model is optimized according to the importance order of hyperparameters through a grid search hyperparameter optimization method.

[0043] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0044] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0045] Therefore, the intrusion detection method for power industrial control systems using the random forest classification model provided in this application can determine whether an attack is occurring because new attacks generate traffic characteristics. These traffic characteristics are fed into a decision tree for classification, and the results can be used to determine whether an attack is occurring. Furthermore, the random forest classification model of this invention employs an improved grid search hyperparameter optimization algorithm. By determining the importance of each hyperparameter and performing a grid search on individual hyperparameters, the computation speed is increased to O(n×m), meeting the speed requirements for intrusion detection in power industrial control systems. Attached Figure Description

[0046] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0047] Figure 1 This is a flowchart illustrating an exemplary embodiment of an intrusion detection method for a power industrial control system provided by the present invention.

[0048] Figure 2 This is a flowchart of an intrusion detection method provided by an exemplary embodiment of the present invention;

[0049] Figure 3 This is a schematic diagram of a random forest classifier model provided in an exemplary embodiment of the present invention;

[0050] Figure 4 This is a schematic diagram of an improved grid search optimization algorithm provided by an exemplary embodiment of the present invention;

[0051] Figure 5 This is a schematic diagram of the classifier model evaluation metrics provided in an exemplary embodiment of the present invention;

[0052] Figure 6 This is a schematic diagram of the structure of an intrusion detection device for a power industrial control system provided in an exemplary embodiment of the present invention;

[0053] Figure 7 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0054] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0055] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0056] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0057] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0058] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0059] Furthermore, the term "and / or" in this invention is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this invention generally indicates that the preceding and following related objects have an "or" relationship.

[0060] It should also be understood that the description of the various embodiments in this invention emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0061] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0062] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0063] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, they should be considered part of the specification.

[0064] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0065] The embodiments of this invention can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Well-known examples of terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0066] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0067] Random Forest: The Random Forest algorithm is an ensemble learning algorithm that uses decision trees as base learners. The basic idea of ​​ensemble learning is to combine multiple models instead of using a single model to solve a problem. Ensemble learning uses multiple different models as base classifiers and then combines them to achieve better performance than a single specific method. The process of selecting a model based on certain conditions to achieve a goal is called a decision tree.

[0068] Hyperparameter optimization: Machine learning algorithms exhibit varying performance across different combinations of hyperparameters. Hyperparameter optimization aims to find the hyperparameters that optimize the algorithm's performance on the test dataset. Hyperparameters are parameters whose values ​​are set before the learning process begins, rather than being derived from training data.

[0069] Power control system: A power control system is a system, intelligent device, and communication network used for monitoring and control within a power network. It consists of a control network and a management network. The management network primarily comprises a monitoring layer, an analysis layer, and a data layer, responsible for caching, analyzing, visualizing, and monitoring the flow data collected by the control network, as well as scheduling the entire network. The control network primarily comprises a station control layer, a bay layer, and a process layer, responsible for collecting, performing basic analysis, and transmitting data from field power equipment.

[0070] Intrusion Detection: Intrusion detection is a network security technology used to detect any actions that damage or attempt to compromise the confidentiality, integrity, or availability of a system. By monitoring the state and activity of the protected system, and employing misuse detection, anomaly detection, or a combination of these methods, it detects unauthorized or malicious intrusion attempts, providing an effective means of preventing intrusions. An intrusion attempt refers to a potential, premeditated, and unauthorized attempt to access and manipulate information, rendering the system unreliable or unusable.

[0071] Exemplary methods

[0072] Figure 1 This is a flowchart illustrating an intrusion detection method for a power industrial control system according to an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as... Figure 1 As shown, the intrusion detection method 100 for power industrial control systems includes the following steps:

[0073] Step 101: Obtain power control system data from the power control system.

[0074] Among them, the data from the power industrial control system has electrical and physical characteristics as well as network traffic characteristics.

[0075] Step 102: Classify the power control system data using a pre-trained random forest classification model to determine the classification result of the power control system data. The classification result is used to indicate whether there is intrusion behavior in the power control system. The random forest classification model is optimized according to the importance order of hyperparameters using a grid search hyperparameter optimization method.

[0076] Specifically, novel attacks generate traffic features, which are fed into a decision tree for classification to determine whether an attack is occurring. The random forest classification model provided in this application can detect novel attacks not seen during training and accurately identify them as attacks during testing. Therefore, novel attacks can be discovered using the random forest classification model provided in this application. This invention proposes an improved grid search hyperparameter optimization algorithm. By determining the importance of each hyperparameter, a grid search is performed on individual hyperparameters, increasing the computation speed to O(n×m), meeting the speed requirements of intrusion detection in power industrial control systems.

[0077] Random forest, as a machine learning algorithm, boasts advantages such as handling high-dimensional data, fast training speed, and good performance, meeting the requirements of speed, accuracy, and complexity intrusion detection in power industrial control systems. When building the classifier model, the random forest algorithm involves adjusting multiple hyperparameters. The setting of these hyperparameters significantly impacts classifier performance. Quickly and accurately finding the optimal hyperparameter combination can greatly improve evaluation metrics such as accuracy, precision, and recall of the classifier, and also facilitates the rapid construction of classifiers to meet the speed requirements of intrusion detection in power industrial control systems.

[0078] Optionally, it also includes: preprocessing the power control system data, and

[0079] Preprocessing operations for power control system data include:

[0080] Delete data with missing values ​​from the power control system data;

[0081] Set the inf value in the power industrial control system data to 1000;

[0082] The power industrial control system data is standardized using pre-set standardized formulas;

[0083] The power control system data is normalized using a pre-set normalization method.

[0084] Alternatively, a random forest classification model can be trained using the following method:

[0085] Obtain historical power industrial control system datasets;

[0086] The first preset percentage of the historical power industrial control system dataset is used as the training dataset, and the second preset percentage of the historical power industrial control system dataset is used as the test dataset.

[0087] Constructing the hyperparameter configuration space for a random forest classification model;

[0088] A random forest classifier is constructed using combinations of hyperparameters in the hyperparameter configuration space.

[0089] Train a random forest classifier using the training dataset;

[0090] The random forest classification model is determined based on the combination of hyperparameters and the random forest classifier.

[0091] Therefore, the selected historical power control system dataset includes electrical physical quantities and network traffic, fully considering the characteristics of power control system operation.

[0092] Optionally, it also includes: preprocessing historical power industrial control system datasets, and

[0093] The preprocessing operations for historical power control system datasets include:

[0094] Remove data with missing values ​​from the historical power industrial control system dataset;

[0095] Set the inf value in the historical power industrial control system dataset to 1000;

[0096] The historical power industrial control system dataset is standardized using a pre-set standardization formula;

[0097] The historical power industrial control system dataset is normalized using a pre-defined normalization method.

[0098] Specifically, step one: Select the power industrial control system dataset and perform data preprocessing.

[0099] The dataset used in this invention comes from a publicly available power system dataset generated collaboratively by Mississippi State University and Oak Ridge National Laboratory. The dataset's characteristics are described in Table 1.

[0100] Table 1. Dataset Features and Descriptions

[0101]

[0102]

[0103] The dataset contains missing values ​​and inf values. Delete the samples with missing values ​​and set the inf value to 8000.

[0104] The data is standardized using the formula shown in (1).

[0105]

[0106] Normalizing the data brings features of different dimensions to the same numerical order of magnitude, thereby reducing the influence of features with large variance and improving the convergence speed and accuracy of the model. The formula used is shown in (2).

[0107]

[0108] The tags are converted into numerical tags, with each type of tag corresponding to a number.

[0109] After preprocessing, the dataset is divided into 80% training set and 20% test set.

[0110] Optionally, it also includes:

[0111] The test dataset was classified using a random forest classifier, and the evaluation metrics for the random forest classifier were determined.

[0112] If the evaluation metrics exceed the pre-set evaluation threshold, the random forest classifier is deemed unqualified.

[0113] Among them, it is required to correctly distinguish between normal and attacked situations, that is, there should be no misjudgment as optimal. Theoretically, if the evaluation threshold is greater than 0.5, it means that the classifier is better than random classification and is qualified. However, to be precise, its evaluation criterion is that the closer it is to 1, the better.

[0114] Optionally, it also includes:

[0115] The roc_auc score is used as the evaluation criterion.

[0116] Specifically, step two: construct a random forest regression model to fit the hyperparameter combination and the corresponding classifier evaluation index.

[0117] First, the dataset required for fitting the random forest regression model is generated. The dataset labels are used as evaluation metrics for the random forest classification model. These metrics need to be determined based on the specific situation; options include accuracy, F1-score, and recall. For power control systems, correctly distinguishing between normal and attacked conditions is equally important, so the ROC_AUC score is chosen as the evaluation criterion for the hyperparameter. The random forest classification model for power control systems proposed in this invention is as follows: Figure 3 As shown.

[0118] refer to Figure 3 As shown, the first step in model building is choosing a sampling method to generate the subset dataset. Whether to use booststrap sampling is the first hyperparameter of the random forest classifier. The second step in model building is constructing decision trees; the number of decision trees is the second hyperparameter. Decision trees have four hyperparameters: maximum depth, split criterion, minimum number of samples for splitting internal nodes, and minimum number of samples for leaf nodes. The features of each decision tree are randomly selected; the seventh hyperparameter of the random forest is the maximum number of selections. Different combinations of these seven hyperparameters affect the performance of the random forest classifier, thus requiring hyperparameter optimization.

[0119] The dataset is characterized by a hyperparameter configuration space, as shown in Table 2. The table illustrates the step size for each hyperparameter, and the range of hyperparameter values ​​must be sufficiently large.

[0120] Table 2 Hyperparameter Configuration Space

[0121]

[0122]

[0123] Each of the seven hyperparameters takes a value within its own range to form a hyperparameter combination. These combinations, when permuted, create a hyperparameter configuration space. The random classifier forest model uses hyperparameter combinations from this configuration space for training. After training, the model is tested on a test dataset to obtain the roc_auc score.

[0124] Optionally, it also includes:

[0125] The importance ranking of hyperparameters in the hyperparameter combination is obtained through a pre-defined functional variance analysis.

[0126] Based on the order of importance of hyperparameters in the hyperparameter combination, grid search optimization is performed on each hyperparameter in turn to determine the optimal hyperparameter combination.

[0127] Replace the hyperparameter combination in the random forest classifier with the optimal hyperparameter combination to determine the optimal random forest classifier;

[0128] The random forest classification model is determined based on the optimal random forest classifier.

[0129] Optionally, the operation of obtaining the order of importance of hyperparameters in a combination of hyperparameters through a pre-defined functional variance analysis includes:

[0130] Functional variance analysis is used to decompose the variance of the predictions of each tree in the random forest classifier into the sum of the variance contributions of multiple hyperparameters.

[0131] The importance ranking of hyperparameters in a hyperparameter combination is determined based on the variance contribution values ​​of multiple hyperparameters in the combination.

[0132] Specifically, step three: ranking the importance of hyperparameters.

[0133] The predicted values ​​for each tree were obtained through functional variance analysis. The variance is decomposed into the sum of the variance contributions of individual hyperparameters, and the functional variance analysis is shown in Equation (3).

[0134]

[0135] In the formula For Θ U Uniform probability density.

[0136] If a certain hyperparameter has a high variance contribution, it means that its change will have a significant impact on the model performance, so it is of high importance and needs to be adjusted first.

[0137] The importance of hyperparameters is ranked according to calculations, as shown in Table 3.

[0138] Table 3. Ranking of Hyperparameter Importance

[0139]

[0140] As shown in Table 3, the order of importance of hyperparameters is: maximum depth of decision tree, minimum number of samples in leaf nodes, minimum number of samples for internal node splits, split criteria, number of decision trees, whether to use bootstrap for sampling, and maximum number of features. This order is the optimization order of individual hyperparameters in the improved grid search hyperparameter optimization algorithm.

[0141] Step 4: Optimize the hyperparameters of the random forest classifier using an improved grid search hyperparameter optimization algorithm.

[0142] Improved grid search hyperparameter optimization steps as follows Figure 4 As shown.

[0143] The single-parameter optimization algorithm is shown in Algorithm 1, where the input is a single hyperparameter Θ. i It has m possible values, and the output is a single optimal hyperparameter.

[0144]

[0145] Initialize the optimal result and optimal hyperparameters. Replace the corresponding hyperparameter values ​​of the random forest classifier with the hyperparameter values ​​one by one. Then train and test the classifier. If the test evaluation index is higher than the previous random forest classifier, retain the hyperparameter value. Finally, obtain the optimal hyperparameter values.

[0146] Therefore, this paper addresses the problem of ranking the importance of hyperparameters in the random forest algorithm, uses functional variance analysis to calculate the impact of hyperparameter values ​​on algorithm performance, and prepares for improving the grid search algorithm. It also solves the problem of slow hyperparameter optimization speed in the random forest classifier by using an improved grid search algorithm to increase the speed of hyperparameter optimization and solve the problem of slow computation speed of the traditional grid search algorithm, thereby quickly building the classifier model.

[0147] Furthermore, this invention proposes an improved grid search hyperparameter optimization algorithm. By determining the importance of hyperparameters, a grid search is performed on individual hyperparameters. The method for determining the importance of computation speed hyperparameters is described. A combination of fitting hyperparameters for a random forest regression model and the classifier evaluation index roc_auc score are constructed. Functional variance analysis is used to decompose the fitting variance into the contribution of individual hyperparameters.

[0148] Furthermore, the improved grid search algorithm proposed in this invention obtains the importance of hyperparameters through functional variance analysis, and proposes a single-parameter optimization algorithm based on the importance ranking, thereby improving the speed of hyperparameter optimization.

[0149] In addition, step five: construct the optimal random forest classifier and perform performance testing on the test dataset.

[0150] Replace the corresponding hyperparameter values ​​of the base classifier with the optimal hyperparameter values ​​obtained in step four to obtain the optimal random forest classifier. The hyperparameter configuration of the classifier is shown in Table 4.

[0151] Table 4. Optimal Classifier Hyperparameter Values

[0152]

[0153] The test dataset is input into the optimal classifier, which then makes judgments and outputs results. TP, TN, FP, and FN are obtained by comparing the predicted "attack" or "normal" results with the actual results. TA represents the model's correct detection of attack records, while FA represents the model's misinterpretation of normal system operation as an attack. TN represents the normal records correctly identified by the model, while FN represents the incorrect identification of an attack on the system during normal system operation. The confusion matrix can be used to evaluate the performance of the proposed model. The goal of this experiment is to reduce the number of FN and FA values ​​in the RF classifier. Accuracy, Precision, Recall, and F1 score can be obtained from TP, TN, FP, and FN. The formulas are as follows:

[0154]

[0155]

[0156]

[0157]

[0158] Test results are as follows Figure 4 As shown, by Figure 4 It can be seen that the classifier's accuracy, precision, recall, and F1-score reached 96.98%, 97.32%, 98.83%, and 98.07%, respectively.

[0159] Therefore, this invention provides an intrusion detection method for power industrial control systems, which solves the problems of high false alarm rate and inability to detect new attacks in power industrial control intrusion detection methods. It can improve the accuracy, precision, recall rate and F1 score of intrusion detection methods, and ensure accurate judgment of whether the power industrial control system has been intruded.

[0160] Furthermore, this invention is achieved through the following technical solution: First, a power industrial control system dataset is selected as the test object. The dataset is preprocessed and divided into a training dataset and a test dataset. Then, a random forest regression model is constructed, and the importance ranking of hyperparameters is obtained based on functional variance analysis. Subsequently, the hyperparameters are optimized one by one by an improved grid search algorithm. The optimal hyperparameter values ​​obtained by the improved grid search algorithm are used to replace the corresponding hyperparameter values ​​of the base classifiers to obtain the optimal classifier model. Finally, the optimal classifier is tested on the test dataset to verify its performance.

[0161] The power industry control system is a crucial component of the nation's critical infrastructure and is at the forefront of cybersecurity attacks. With the deepening application of information technology, the cyber-physical domain of power industry control systems is gradually becoming more integrated, and various network disruptions and attacks are evolving rapidly. This results in high false alarm and false negative rates for power industry control system intrusion detection systems, making it difficult to effectively identify advanced persistent threat attacks targeting power industry control systems.

[0162] Intrusion detection technology (IDT) is an essential complement to traditional firewall solutions, providing an effective method for detecting malicious attacks against industrial control systems (ICS). Besides identifying malicious activities that violate the security policies of power control systems, IDT can also provide evidence to notify system administrators to respond appropriately to network attacks. Therefore, IDT can effectively prevent major damage to power control systems, and developing effective IDT technologies plays a crucial role in protecting the security of power control systems.

[0163] Random forest, as a machine learning algorithm, boasts advantages such as handling high-dimensional data, fast training speed, and good performance, meeting the requirements of speed, accuracy, and complexity intrusion detection in power industrial control systems. When building the classifier model, the random forest algorithm involves adjusting multiple hyperparameters. The setting of these hyperparameters significantly impacts classifier performance. Quickly and accurately finding the optimal hyperparameter combination can greatly improve evaluation metrics such as accuracy, precision, and recall of the classifier, and also facilitates the rapid construction of classifiers to meet the speed requirements of intrusion detection in power industrial control systems.

[0164] In addition, refer to Figure 2As shown, firstly, an original dataset with electrical and physical characteristics and network traffic characteristics is imported as the research object. The dataset undergoes data preprocessing to meet the input requirements of the intrusion detection method. After preprocessing, the original dataset is split into training and testing datasets at ratios of 80% and 20%, respectively. Secondly, a hyperparameter configuration space is constructed, and a random forest classifier is built using the hyperparameter combinations in the space. The classifier is trained using the training dataset, and then the test dataset is used to classify the classifier, obtaining its evaluation metric. Then, using the hyperparameter combinations in the configuration space as features and the corresponding classifier evaluation metrics as labels, a random forest regression model is constructed for fitting, and the importance ranking of the hyperparameters is obtained through functional variance analysis. Next, grid search optimization is applied to each hyperparameter according to its importance ranking, and the optimal hyperparameter replaces the corresponding hyperparameter value in the base classifier. Finally, the best hyperparameter combination is obtained, the optimal random forest classifier is constructed, and its classification effect is verified using the test dataset.

[0165] Novel attacks generate traffic features, which are fed into a decision tree for classification to determine whether an attack is occurring. The random forest classification model provided in this application may only handle a subset of attack types during training, but it can still detect and accurately identify novel attacks during testing. Therefore, the random forest classification model provided in this application can discover novel attacks.

[0166] Furthermore, this invention addresses the shortcomings of commonly used intrusion detection methods for power industrial control systems, which fail to adequately consider the characteristics of these systems and the differences between intrusion detection in power industrial control systems and traditional information system intrusion detection. It proposes an intrusion detection method for power industrial control systems based on a hyperparameter-optimized random forest algorithm. This method leverages the advantages of random forests—their ability to handle high-dimensional data, fast training speed, and good performance—to quickly and accurately identify intrusion behavior.

[0167] To further improve model performance, hyperparameter tuning of the random forest classifier is necessary. Traditional grid search hyperparameter optimization algorithms suffer from slow computation speed and consume significant computational resources and time when there are many hyperparameters to be tuned. This invention proposes an improved grid search hyperparameter optimization algorithm. By determining the importance of each hyperparameter and performing a grid search on individual hyperparameters, the computation speed is increased to O(n×m), meeting the speed requirements of intrusion detection in power control systems.

[0168] Improving hyperparameter optimization in grid search relies on determining the importance of hyperparameters. Functional analysis of variance (ANOVA) is used to decompose the prediction variance of the random forest regression model into the contribution of individual hyperparameters, thereby determining their importance. The dataset used for the random forest regression model prediction is characterized by a hyperparameter configuration space, with labels representing the classifier evaluation metric, roc_auc score. The method used to determine hyperparameter importance constructs the combination of fitting hyperparameters for the random forest regression model and the classifier evaluation metric, roc_auc score, and uses functional analysis of variance to decompose the fitting variance into the contribution of individual hyperparameters.

[0169] This invention replaces the corresponding hyperparameter values ​​in the base classifier with the optimal hyperparameter values ​​obtained from the improved grid search algorithm to obtain the optimal classifier. The classifier's accuracy, precision, recall, and F1-score reach 96.98%, 97.32%, 98.83%, and 98.07%, respectively, solving the problem of high false alarm and false negative rates in intrusion detection of power industrial control systems.

[0170] The beneficial effects of this invention are as follows:

[0171] 1. The intrusion detection method for power industrial control systems based on hyperparameter-optimized random forest algorithm proposed in this invention differs from traditional information systems. It uses the random forest algorithm to build an intrusion detection model for power industrial control systems, and the selected dataset includes electrical physical quantities and network traffic, fully considering the characteristics of power industrial control systems during operation.

[0172] 2. To further improve model performance, hyperparameter tuning of the random forest classifier is necessary. Traditional grid search hyperparameter optimization algorithms suffer from slow computation speed and consume significant computational resources and time when there are many hyperparameters to be tuned. This invention proposes an improved grid search hyperparameter optimization algorithm. By determining the importance of each hyperparameter, a grid search is performed on individual hyperparameters. This method combines computational speed with hyperparameter importance determination, constructs a combination of fitting hyperparameters for the random forest regression model, and establishes the roc_auc score as a classifier evaluation metric. Functional analysis of variance is used to decompose the fitting variance into the contribution of individual hyperparameters.

[0173] 3. The improved grid search algorithm proposed in this invention obtains the importance of hyperparameters through functional variance analysis, and proposes a single-parameter optimization algorithm based on the importance ranking, thereby improving the speed of hyperparameter optimization.

[0174] Exemplary device

[0175] Figure 6 This is a schematic diagram of the structure of an intrusion detection device for a power industrial control system provided in an exemplary embodiment of the present invention. Figure 6 As shown, the device 600 includes:

[0176] The first acquisition module is used to acquire power control system data from the power control system.

[0177] The first determination module is used to classify the power control system data using a pre-trained random forest classification model and determine the classification result of the power control system data. The classification result is used to indicate whether there is intrusion behavior in the power control system. The random forest classification model is optimized according to the importance order of hyperparameters through a grid search hyperparameter optimization method.

[0178] Optionally, the device 600 further includes: a first preprocessing module for preprocessing the power control system data, and

[0179] The first preprocessing module includes:

[0180] The first deletion submodule is used to delete data with missing values ​​from the power industrial control system data;

[0181] The first setting submodule is used to set the inf value in the power industrial control system data to 1000;

[0182] The first standardization processing submodule is used to standardize the power control system data using pre-set standardization formulas.

[0183] The first normalization processing submodule is used to normalize the power industrial control system data using a pre-set normalization method.

[0184] Optionally, the device 600 further includes: training a random forest classification model by means of:

[0185] The second acquisition module is used to acquire historical power industrial control system datasets;

[0186] As a module, it is used to use a first preset percentage of the historical power industrial control system dataset as a training dataset and a second preset percentage of the historical power industrial control system dataset as a test dataset.

[0187] The first building block is used to construct the hyperparameter configuration space for the random forest classification model;

[0188] The first building module is used to construct a random forest classifier using combinations of hyperparameters in the hyperparameter configuration space;

[0189] The training module is used to train a random forest classifier using the training dataset;

[0190] The second determination module is used to determine the random forest classification model based on the combination of hyperparameters and the random forest classifier.

[0191] Optionally, the device 600 further includes: a second preprocessing module for preprocessing the historical power industrial control system dataset, and

[0192] The second preprocessing module includes:

[0193] The second deletion submodule is used to delete data with missing values ​​from the historical power industrial control system dataset;

[0194] The second setting submodule is used to set the inf value in the historical power industrial control system dataset to 1000;

[0195] The second standardization processing submodule is used to standardize the historical power industrial control system dataset using a pre-set standardization formula;

[0196] The second normalization processing submodule is used to normalize the historical power industrial control system dataset using a pre-set normalization method.

[0197] Optionally, the device 600 further includes:

[0198] The third determination module is used to classify the test dataset using a random forest classifier and determine the evaluation metrics of the random forest classifier.

[0199] The judgment module is used to determine that the random forest classifier is unqualified if the evaluation index exceeds the preset evaluation threshold.

[0200] Optionally, the device 600 further includes:

[0201] A module is used to evaluate the system using the roc_auc score as the assessment metric.

[0202] Optionally, the device 600 further includes:

[0203] The ranking module is used to obtain the ranking of the importance of hyperparameters in the hyperparameter combination through a pre-defined functional variance analysis.

[0204] The fourth determination module is used to perform grid search optimization on each hyperparameter according to the importance ranking of the hyperparameters in the hyperparameter combination, and determine the optimal hyperparameter combination.

[0205] The fifth determination module is used to replace the hyperparameter combination in the random forest classifier with the optimal hyperparameter combination to determine the optimal random forest classifier;

[0206] The sixth determination module is used to determine the random forest classification model based on the optimal random forest classifier.

[0207] Optionally, the sorting module includes:

[0208] The decomposition submodule is used to decompose the variance of the predictions of each tree in the random forest classifier into the sum of the variance contributions of multiple hyperparameters through functional variance analysis.

[0209] The determination submodule is used to determine the importance ranking of hyperparameters in a hyperparameter combination based on the variance contribution values ​​of multiple hyperparameters in the hyperparameter combination.

[0210] Exemplary electronic devices

[0211] Figure 7 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. The electronic device may be either or both of a first device and a second device, or a standalone device independent of them, which may communicate with the first device and the second device to receive acquired input signals from them. Figure 7 A block diagram of an electronic device according to an embodiment of the present invention is illustrated. Figure 7 As shown, the electronic device 700 includes one or more processors 701 and memory 702.

[0212] The processor 701 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0213] The memory 702 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 701 may execute the program instructions to implement the methods for information mining of historical change records and / or other desired functions of the software programs of the various embodiments of the present invention described above. In one example, the electronic device may also include an input device 703 and an output device 704, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0214] In addition, the input device 703 may also include, for example, a keyboard, a mouse, etc.

[0215] The output device 704 can output various information to the outside. The output device 704 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0216] Of course, for the sake of simplicity, Figure 7 Only some of the components of the electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0217] Exemplary computer program products and computer-readable storage media

[0218] In addition to the methods and devices described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps of the methods for information mining of historical change records according to various embodiments of the present invention as described in the "Exemplary Methods" section of this specification.

[0219] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0220] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods for information mining of historical change records according to various embodiments of the present invention as described in the "Exemplary Methods" section above.

[0221] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0222] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0223] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0224] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0225] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0226] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0227] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for intrusion detection in a power industrial control system, characterized in that, include: Acquire power control system data; The power control system data is classified using a pre-trained random forest classification model to determine the classification result of the power control system data. The classification result is used to indicate whether there is intrusion behavior in the power control system. The random forest classification model is optimized according to the importance order of hyperparameters using a grid search hyperparameter optimization method. The random forest classification model was trained using the following method: Obtain historical power industrial control system datasets; The first preset percentage of the historical power industrial control system dataset is used as the training dataset, and the second preset percentage of the historical power industrial control system dataset is used as the test dataset. Construct the hyperparameter configuration space of the random forest classification model; A random forest classifier is constructed using combinations of hyperparameters in the hyperparameter configuration space. The random forest classifier is trained using the training dataset. The random forest classification model is determined based on the hyperparameter combination and the random forest classifier. The method further includes: The importance ranking of hyperparameters in the hyperparameter combination is obtained through a pre-defined functional variance analysis. Based on the order of importance of the hyperparameters in the hyperparameter combination, grid search optimization is performed on each hyperparameter in turn to determine the optimal hyperparameter combination. Replace the hyperparameter combination in the random forest classifier with the optimal hyperparameter combination to determine the optimal random forest classifier; The random forest classification model is determined based on the optimal random forest classifier.

2. The method according to claim 1, characterized in that, Also includes: The power control system data is preprocessed, and The preprocessing operations for the power control system data include: Delete data with missing values ​​from the power control system data; Set the inf value in the power industrial control system data to 1000; The power control system data is standardized using a pre-set standardized formula. The power control system data is normalized using a pre-set normalization method.

3. The method according to claim 1, characterized in that, Also includes: The historical power industrial control system dataset is preprocessed, and The preprocessing operations for the historical power industrial control system dataset include: Delete the data with missing values ​​from the historical power industrial control system dataset; Set the inf value in the historical power industrial control system dataset to 1000; The historical power industrial control system dataset is standardized using a pre-set standardization formula. The historical power industrial control system dataset is normalized using a pre-set normalization method.

4. The method according to claim 1, characterized in that, Also includes: The test dataset is classified using the random forest classifier, and the evaluation metric of the random forest classifier is determined. If the evaluation metric exceeds a pre-set evaluation threshold, the random forest classifier is deemed unqualified.

5. The method according to claim 4, characterized in that, Also includes: The roc_auc score is used as the evaluation standard for the aforementioned evaluation index.

6. The method according to claim 1, characterized in that, The operation of obtaining the order of importance of hyperparameters in the hyperparameter combination through pre-defined functional variance analysis includes: The variance of the predicted value of each tree in the random forest classifier is decomposed into the sum of the variance contributions of multiple hyperparameters through the functional variance analysis. The importance ranking of the hyperparameters in the hyperparameter combination is determined based on the variance contribution values ​​of multiple hyperparameters in the hyperparameter combination.

7. An intrusion detection device for a power industrial control system, used to implement the method of claim 1, characterized in that, include: The first acquisition module is used to acquire power control system data from the power control system. The first determination module is used to classify the power industrial control system data using a pre-trained random forest classification model and determine the classification result of the power industrial control system data. The classification result is used to indicate whether there is intrusion behavior in the power industrial control system. The random forest classification model is optimized according to the importance order of hyperparameters using a grid search hyperparameter optimization method.

8. The apparatus according to claim 7, characterized in that, Also includes: The first preprocessing module is used to preprocess the data of the power industrial control system, and The first preprocessing module includes: The first deletion submodule is used to delete data with missing values ​​from the power industrial control system data; The first setting submodule is used to set the inf value in the power industrial control system data to 1000; The first standardization processing submodule is used to standardize the power control system data using a pre-set standardization formula; The first normalization processing submodule is used to normalize the power industrial control system data using a pre-set normalization method.

9. The apparatus according to claim 7, characterized in that, Also includes: The second preprocessing module is used to preprocess the historical power industrial control system dataset, and The second preprocessing module includes: The second deletion submodule is used to delete data with missing values ​​from the historical power industrial control system dataset; The second setting submodule is used to set the inf value in the historical power industrial control system dataset to 1000; The second standardization processing submodule is used to standardize the historical power industrial control system dataset using a pre-set standardization formula; The second normalization processing submodule is used to normalize the historical power industrial control system dataset using a pre-set normalization method.

10. The apparatus according to claim 7, characterized in that, Also includes: The third determination module is used to classify the test dataset using the random forest classifier and determine the evaluation metric of the random forest classifier. The judgment module is used to determine that the random forest classifier is unqualified when the evaluation index exceeds a preset evaluation threshold.

11. The apparatus according to claim 10, characterized in that, Also includes: A module is used to employ the roc_auc score as the evaluation criterion for the evaluation index.

12. The apparatus according to claim 7, characterized in that, The sorting module includes: The decomposition submodule is used to decompose the variance of the predicted value of each tree in the random forest classifier into the sum of the variance contributions of multiple hyperparameters through the functional variance analysis. The determination submodule is used to determine the importance ranking of the hyperparameters in the hyperparameter combination based on the variance contribution values ​​of multiple hyperparameters in the hyperparameter combination.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-6.

14. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-6.

Images