Power CPS intrusion detection system and method based on multi-objective variable-length CNN discrete optimization

Abstract

The present invention discloses an electric CPS intrusion detection system and method based on multi-objective variable-length CNN discrete optimization. The pre-processed historical monitoring data of the electric information-physical system is used as the input data set, and the number of convolution modules, model topology, architectural parameters of each convolution module and batch size, learning rate, optimizer type, weight regularization and other hyperparameters used to construct the convolutional neural network model are variable-length discretely encoded. The indicators of the CNN model on the validation set and the number of model floating-point operations are used as optimization targets. A multi-objective discrete optimization method is designed to perform multi-objective parallel optimization on the CNN model architecture and parameters based on the variable-length convolution module, thereby obtaining a Pareto optimal CNN model that takes into account both model performance and model complexity. For the real-time monitoring data of the electric CPS, the optimal CNN model is deployed online, thereby realizing online intrusion detection of the electric CPS. The present invention reduces the complexity of the model while ensuring high-precision performance indicators of the model.

Description

Technical Field

[0001] The present invention relates to intelligent intrusion detection technology in the field of smart grid information security, and in particular to an electric power CPS intrusion detection system and method based on multi-objective variable-length CNN discrete optimization. Background Art

[0002] With the development of communication technology and intelligent control equipment in power systems, smart grids are facing challenges such as an increase in information types and complex and diverse data. Cyber-physical systems (CPSs) are systems that use modern sensors, computers, and network technologies to efficiently integrate network and physical components, and have been widely used in power systems. On the one hand, power CPSs significantly improve the efficiency of data collection and processing in power systems. On the other hand, due to the complex interaction mechanism of CPSs, there are many vulnerabilities that can be invaded in the communication between information components, the interaction between information and physical systems, and the operating system and software. With the application and development of power CPSs, these vulnerabilities have led to an increasing number of security threats to smart grids.

[0003] To address growing security threats, power CPSs typically deploy online intrusion detection systems to monitor system status in real time. These systems provide prompt alerts and handle anomalies when the system status deviates, thereby defending against various malicious attacks and ensuring the security of power CPSs. However, due to the specific characteristics of power CPSs, such as their high real-time requirements, wide coverage areas, and limited bandwidth of some communication links, intrusion detection technologies used in traditional internet applications cannot be directly applied to power CPSs. Currently, intrusion detection technologies for power CPSs primarily include feature-based and anomaly-based detection techniques, but these techniques generally suffer from low detection efficiency and accuracy, and high rates of missed detections and false alarms.

[0004] In recent years, academic and engineering communities have employed deep neural networks (DNNs), such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs), in an attempt to develop high-performance deep learning-based intrusion detection solutions for power CPSs. However, existing DNN model architecture design and hyperparameter tuning for power CPS intrusion detection primarily rely on manual design by designers and engineers. This not only relies heavily on experience and trial-and-error for specific scenarios, consuming significant time and effort, but also results in complex neural network models that are difficult to deploy online and implement in engineering projects. These models also struggle to meet the high-precision and real-time requirements of power CPS intrusion detection. These factors have significantly hindered the widespread application of DNNs in power CPS intrusion detection. On the other hand, automated deep learning technology has made rapid progress in recent years, but current research results primarily focus on traditional image and speech recognition, with few reports on their application in power CPS intrusion detection. Furthermore, due to the unique challenges faced by power CPS intrusion detection, such as high real-time requirements, wide coverage, and limited bandwidth in some communication links, existing automated DNN key technologies used in traditional image and speech recognition fields are difficult to directly apply to power CPS intrusion detection. In addition, the existing research results of automatic deep neural network for traditional image recognition and speech recognition mainly focus on the field of single deep neural network architecture optimization technology or single hyperparameter optimization technology, and the complexity of designing deep neural network models is usually high. At present, the automatic deep learning technology for smart grid intrusion detection only includes the synchronous optimization of parameters and architectures by genetic algorithm with CNN blocks (abbreviated as SOPA-GA-CNN), but this technology has the following shortcomings: (1) This technology is essentially a single-objective optimization technology, which does not comprehensively consider the trade-off optimization between smart grid intrusion detection performance and CNN model complexity, making it difficult to obtain a compromise solution that takes into account both intrusion detection performance and model lightweight; (2) The number of CNN convolution modules used in this technology is a fixed value, and the encoding method used is a fixed-length fixed-length encoding, which leads to a lack of flexibility in the automatic optimization design; (3) The optimization tool used in this technology is a single-objective genetic algorithm based on population evolution, and the computational cost required for the population evolution process is higher than that of the optimization technology based on individual evolution. However, there are no reports on the development of technologies that comprehensively consider multiple performance indicators, such as high performance of power CPS intrusion detection and lightweight deep neural network models, and simultaneously optimize neural network architecture and hyperparameters. Therefore, the development of new power CPS intrusion detection technologies based on multi-objective variable-length deep neural network architecture and parallel automatic hyperparameter optimization is urgently needed. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a power CPS intrusion detection system and method based on multi-objective variable-length CNN discrete optimization.

[0006] The object of the present invention is achieved through the following technical solutions: a power CPS intrusion detection system based on multi-objective variable-length CNN discrete optimization, characterized in that the system includes a data acquisition module, an offline optimization training module and an online detection module for power CPS intrusion detection;

[0007] The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs standardization based on the standard score to obtain an offline training data set, which is input into the offline optimization training module of the power CPS intrusion detection; collects real-time monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs standardization based on the standard score to obtain an online detection data set, which is input into the online detection module of the power CPS intrusion detection;

[0008] The offline optimization training module of the power CPS intrusion detection is based on a multi-objective variable-length CNN parallel discrete optimization platform. The number of convolution modules, model topology, architectural parameters of each convolution module, batch size, learning rate, optimizer type, weight regularization and other hyperparameters used to construct the variable-length CNN model are discretely encoded. The (1-F1 score) index of the CNN model on the validation set and the number of model floating-point operations per second (FLOPs) are used as optimization targets. A multi-objective discrete optimization method is used to parallel optimize the CNN model architecture and parameters based on the variable-length convolution module, thereby obtaining the architecture and hyperparameter information of the Pareto optimal CNN model that takes into account both model performance and model complexity. The Pareto optimal CNN model is constructed and pre-trained, and the pre-trained optimal CNN model is transmitted to the online detection module.

[0009] The power CPS intrusion detection online detection module is based on the pre-trained optimal CNN model, and performs online deployment of the optimal CNN model. If an intrusion sample is detected, an alarm message is generated and the intrusion detection performance index is evaluated;

[0010] A power CPS intrusion detection method based on multi-objective variable-length CNN discrete optimization includes the following steps:

[0011] (1) The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS. After data analysis, the reading information of each sensor of the power CPS is obtained to obtain the source data set, which is marked as X. For all samples in X, the standard score is normalized according to formula (1) to obtain the offline training data set, which is marked as X. o , input into the offline optimization training module of power CPS intrusion detection based on multi-objective variable-length CNN parallel discrete optimization platform, and convert X o Split into training set X in a ratio of 9:1 ot With the validation set X ov ;

[0012]

[0013] Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j Represents the feature of the j-th dimension of the source dataset X, μ j represents the mean of the j-th dimension feature of X, σ j represents the standard deviation of the j-th dimension feature of X, and d represents the maximum value of the feature dimension of X;

[0014] (2) Setting parameter values ​​based on the multi-objective variable-length CNN parallel discrete optimization platform, including the number of iterative optimizations G for the variable-length CNN model architecture and the multi-objective parallel optimization of hyperparameters, the maximum size AR of the optimal external archive solution set, and the maximum size AR of the optimal external archive solution set. max , the lower limit of the number of convolution modules of the CNN model C L , the upper limit of the number of convolution modules of the CNN model C H , the variable-length CNN model architecture and hyperparameter multi-objective parallel optimization phase offline training round TP1 and the test phase offline training round TP2, initialize the optimal external archive solution set S Archive is an empty set;

[0015] (3) In C L to C H A random individual is generated within the range and marked as s N , which represents the architecture and hyperparameter information of the variable-length CNN model, s N The encoding form is s N ={n,setting,topo,conv1,…,conv i ,…,conv n}, n represents the number of convolutional modules in the model, n = Randint(C L ,C H ), where Randint(C L ,CH ) means randomly generating a range in [C L ,C H ] integer, setting represents the training parameters of the convolutional neural network model, topo represents the topological parameters of the convolutional neural network model, conv i Represents the parameters of the i-th convolution module, 1≤i≤n. The setting is composed of a 4-bit integer code and is defined as shown in formula (2):

[0016]

[0017] Where Randint represents the random integer generation function, Randint(0,3) represents the random generation of an integer from 0 to 3, bs represents the encoding of the training batch size, and the training batch size of the convolutional neural network model is 256×(bs+1); opt represents the encoding of the convolutional neural network model optimizer type, and the corresponding relationship between the opt value and the optimizer type is shown in formula (3):

[0018]

[0019] Where SGD represents the stochastic gradient descent optimizer, Adam represents the adaptive moment estimation optimizer, AdaDelta represents the improved adaptive learning rate optimizer, and Rmsprop represents the root mean square propagation optimizer. lr represents the encoding of the learning rate of the convolutional neural network model, and the learning rate of the convolutional neural network model is set to (lr+1)×2.5×10 -4 ; reg represents the encoding of the weight regularization type of the convolutional neural network model. The corresponding relationship between the reg value and the weight regularization type is shown in formula (4):

[0020]

[0021] Among them, None means that no regularization constraint is applied to the model weights, L1 means that L1 regularization constraint is applied to the weights, L2 means that L2 regularization constraint is applied to the weights, and L1∧L2 means that both L1 and L2 regularization constraints are applied to the weights.

[0022] Topo represents n×(n-1) / 2 bit binary code, which is defined as topo=[bin1,…,bin i ,…,bin n×(n-1) / 2 ],bin i =Randint(0,1), where bin iRepresents the i-th binary code in topo, and Randint(0,1) represents a random integer between 0 and 1. After generating topo, its n×(n-1) / 2-bit binary codes are assigned one by one to an upper triangular matrix A of size (n-1)×(n-1) as shown in formula (5) to represent the network topology information of the convolutional neural network model. The only starting point of the network topology is the first convolution module. For the element a in the i-th row and j-th column of A, i,j , if a i,j =1, it means that the i-th convolutional module in the network is connected to the j+1-th convolutional module, otherwise it means that there is no direct connection between the two modules;

[0023]

[0024] conv i It is composed of 5-bit integer codes and is defined as shown in formula (6):

[0025]

[0026] Where knum represents the encoding of the number of convolution kernels. The number of convolution kernels in the convolution module is 8×(knum+1); ksize represents the encoding of the convolution kernel size. The convolution kernel size in the convolution module is ksize×2+3; kact represents the encoding of the convolution kernel activation function type. The corresponding relationship between the kact value and the convolution kernel activation function in the convolution module is shown in formula (7):

[0027]

[0028] The definition of each activation function is shown in formula (8), where x represents the output value of the convolution module during forward propagation, x i represents the i-th output value in x, and a represents the slope of the Elu function in the negative part:

[0029]

[0030] pt represents the encoding of the pooling layer type of the convolution module. The corresponding relationship between the pt value and the pooling layer type in the module is shown in formula (9):

[0031]

[0032] Among them, None means that the module does not contain a pooling layer, Maxpooling means that the module contains a maximum pooling layer, and Meanpooling means that the module contains an average pooling layer; ps represents the pooling kernel size encoding. If the module contains a pooling layer, its pooling kernel size is 2×ps+3;

[0033] (4) For s Nn, setting, topo, conv i Each coding position (1≤i≤n) is mutated individually in turn, and the n+3 individuals generated by each round of mutation are taken as the population S, S={s1,…,s j ,…,s n+3}, s1, s j , s n+3 They represent the first individual, the jth individual and the n+3th individual generated by the mutation, 1≤j≤n+3. The specific implementation of the mutation operation is as follows: N Each coding position in the sequence is taken as a variation site to determine the coding category of the coding position; if the coding category is n, then according to n=Randint(C L ,C H ) randomly generates an integer n, randomly generates a 4-bit integer code setting according to formula (2), randomly generates a binary code topo with a length of n×(n-1) / 2 according to formula (5), and randomly generates an integer code with a length of 5n according to formula (6) {conv i ,1≤i≤n}, the above randomly generated n, setting, topo, conv i The codes of (1≤i≤n) are combined into a new variant individual in sequence and marked as s1; if the code category is setting, a 4-bit integer code is randomly generated according to formula (2) to replace s N The original setting in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s2; if the coding type is topo, a binary code of length n×(n-1) / 2 is randomly generated to replace s N The original topo in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s3; if the encoding type is convolution module conv i (1≤i≤n), then randomly generate a 5-bit integer code according to formula (6) to replace s N The original conv i , and s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s (3+i) (1≤i≤n);

[0034] (5) The performance of the population S is evaluated. The specific process is as follows: According to the architecture and parameter information of each individual representation in S, it is converted into the corresponding convolutional neural network model, and the offline training dataset X is converted into ot As the data input of each convolutional neural network model, TP1 rounds of offline training are performed according to the parameter information in the encoding; after the training is completed, the performance of each individual in the validation set X is counted.ov The first optimization goal f1 of the CNN is f1 = (1-F1 score), and the second optimization goal f2 of each individual is calculated, that is, f2 = the number of floating-point operations (FLOPs) of the CNN model. The calculation formula of the F1 score is shown in formula (10):

[0035]

[0036] Where TP represents the number of abnormal power CPS data samples correctly predicted as abnormal classification, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal classification, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal classification;

[0037] (6) Perform a fast non-dominated sort on the population S and denote the Pareto frontier solution set of S as S PF , randomly from S PF Select an individual from the best ; unconditionally accept N =s best ;

[0038] (7) s best Join S Archive After that, S Archive Perform fast non-dominated sorting and sort S Archive The Pareto frontier solution set is marked as S APF , and calculate the crowding degree of all individuals, and sort them in ascending order according to the crowding degree value. APF The number of individuals in is greater than AR max , then starting from the individual with the highest crowding degree, remove S APF Individuals with higher crowding rankings in the middle, until S APF The number of individuals in is exactly equal to AR max Individual crowding degree I d The calculation method of is: for the two individuals on the Pareto frontier, the crowding degree is positive infinity; for other individuals, the crowding degree is calculated as shown in formula (11):

[0039]

[0040] Among them, I d represents the crowding value of the dth individual, m represents the number of optimization targets, represents the fitness value of the jth target of the d+1th individual, represents the fitness value of the jth target of the d-1th individual, where 2≤d≤n+2, m=2;

[0041] (8) Unconditionally accept SArchive =S APF ;

[0042] (9) Repeat steps (4) to (8) until the set number of iterative optimization times G is met;

[0043] (10) The optimal external archive solution set S finally obtained from the offline optimization training module Archive Select an individual closest to the lower left corner in the Pareto frontier, build the optimal CNN model based on the optimal architecture and hyperparameter information represented by the individual, and use the offline training dataset X ot As the data input of the optimal CNN model, and perform TP2 rounds of offline training;

[0044] (11) The data acquisition module collects real-time monitoring data of power information from the power CPS, analyzes the data to obtain the reading information of each sensor, and performs standardization based on the standard score, which is used as the online detection data set of the online intrusion detection module and marked as X. t ;

[0045] (12) Using the online detection module of the power CPS intrusion detection, the optimal CNN model pre-trained in step (10) is deployed online to detect the online detection dataset X t Perform online intrusion detection. If an abnormal sample is detected, an intrusion detection alarm message is generated, and the performance indicators of intrusion detection such as F1 score, accuracy, precision and recall are calculated according to formulas (10), (12), (13) and (14) respectively.

[0046]

[0047]

[0048]

[0049] Among them, TP represents the number of abnormal power CPS data samples correctly predicted as abnormal classification, TN represents the number of normal power CPS data samples correctly predicted as normal classification, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal classification, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal classification.

[0050] The beneficial effect of this patent is that compared with the existing technology, the present invention can realize the variable-length CNN model architecture and multi-objective parallel optimization of hyperparameters and automatic design of the model suitable for power CPS intrusion detection, which greatly reduces the dependence on the manual design experience of designers and engineers, improves the intelligent design level and design efficiency of power CPS intrusion detection, and reduces the complexity of the model while ensuring the high-precision performance indicators of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of the principle of the power CPS intrusion detection system and method based on multi-objective variable-length CNN discrete optimization;

[0052] Figure 2 is a randomly generated individual s N Variable length coding example diagram, in this example, the number of convolution modules n = 4 for building the CNN model;

[0053] Figure 3 It is the process of parallel optimization of multi-objective variable-length CNN architecture and parameters. N An example diagram of a successive discretization mutation operation. In this example, s N For n=4, 7 mutant individuals were generated according to the mutation operation of this patented technology;

[0054] Figure 4 This is an example diagram of how individual encoding information is converted into the corresponding CNN model;

[0055] Figure 5 It is the external archived Pareto frontier graph obtained by the offline optimization training module;

[0056] Figure 6 : The figure compares the performance indicators and model complexity of the technology of the present invention and the existing single-objective CNN architecture and parameter parallel optimization technology based on genetic algorithm (Synchronous Optimization of Parameters and Architectures by Genetic Algorithm with CNN Blocks, abbreviated as SOPA-GA-CNN) in power CPS intrusion detection. Sub-figure (a) compares the technology of the present invention and the existing SOPA-GA-CNN technology in terms of four performance indicators: F1 score, accuracy, precision and recall rate. Sub-figure (b) compares the technology of the present invention and the SOPA-GA-CNN technology in terms of floating-point operations per second (FLOPs). The unit of FLOPs is one million. DETAILED DESCRIPTION

[0057] The present invention will be further described below with reference to the accompanying drawings, and the purpose and effects of the present invention will become more apparent.

[0058] Taking a power CPS intrusion detection system as an example, Figure 1 A schematic diagram of the principle of a power CPS intrusion detection system and method based on multi-objective variable-length CNN parallel discrete optimization is given. The system includes a data acquisition module, an offline optimization training module, and an online detection module for power CPS intrusion detection.

[0059] The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs standardization based on the standard score to obtain an offline training data set, which is input into the offline optimization training module of the power CPS intrusion detection; collects real-time monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs standardization based on the standard score to obtain an online detection data set, which is input into the online detection module of the power CPS intrusion detection;

[0060] The offline optimization training module of the power CPS intrusion detection is based on a multi-objective variable-length CNN parallel discrete optimization platform. The number of convolution modules, model topology, architectural parameters of each convolution module, batch size, learning rate, optimizer type, weight regularization and other hyperparameters used to construct the variable-length CNN model are discretely encoded. The (1-F1 score) index of the CNN model on the validation set and the number of floating-point operations per second (FLOPs) of the model are used as optimization targets. A multi-objective discrete optimization method is used to parallel optimize the CNN model architecture and parameters based on the variable-length convolution module, thereby obtaining the architecture and hyperparameter information of the Pareto optimal CNN model that takes into account both model performance and model complexity. The Pareto optimal CNN model is constructed and pre-trained, and the pre-trained optimal CNN model is transmitted to the online detection module.

[0061] The power CPS intrusion detection online detection module is based on the pre-trained optimal CNN model, and performs online deployment of the optimal CNN model. If an intrusion sample is detected, an alarm message is generated and the intrusion detection performance index is evaluated;

[0062] The system is based on a multi-objective variable-length CNN discrete optimization method for power CPS intrusion detection. The specific implementation process is as follows:

[0063] (1) The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS. After data analysis, the reading information of each sensor of the power CPS is obtained to obtain the source data set, which is marked as X. For all samples in X, the standard score is normalized according to formula (1) to obtain the offline training data set, which is marked as X. o , input into the offline optimization training module of power CPS intrusion detection based on multi-objective variable-length CNN parallel discrete optimization platform, and convert X o Split into training set X in a ratio of 9:1 ot With the validation set X ov ;

[0064]

[0065] Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j Represents the feature of the j-th dimension of the source dataset X, μ j represents the mean of the j-th dimension feature of X, σ j represents the standard deviation of the j-th dimension feature of X, and d represents the maximum value of the feature dimension of X. In this implementation case, d = 128;

[0066] (2) Setting the parameter values ​​based on the multi-objective variable-length CNN parallel discrete optimization platform, including the number of iterative optimizations G = 200 for the variable-length CNN model architecture and the multi-objective parallel optimization of hyperparameters, the maximum size AR of the optimal external archive solution set, and the maximum size AR of the optimal external archive solution set. max =20, the lower limit of the number of convolution modules in the CNN model C L =3, the upper limit of the number of convolution modules in the CNN model C H = 10, the number of offline training rounds TP1 = 50 in the variable-length CNN model architecture and hyperparameter multi-objective parallel optimization phase and the number of offline training rounds TP2 = 350 in the test phase, and the initialization of the optimal archive solution set S Archive is an empty set;

[0067] (3) In C L to C H A random individual is generated within the range and marked as s N , which represents the architecture and hyperparameter information of the variable-length CNN model, s N The encoding form is s N ={n,setting,topo,conv1,…,conv i ,…,conv n}, n represents the number of convolutional modules in the model, n = Randint(C L ,C H), where Randint(C L ,C H ) means randomly generating a range in [C L ,C H ] integer, setting represents the training parameters of the convolutional neural network model, topo represents the topological parameters of the convolutional neural network model, conv i Represents the parameters of the i-th convolution module, 1≤i≤n. The setting is composed of a 4-bit integer code and is defined as shown in formula (2):

[0068]

[0069] Where Randint represents the random integer generation function, Randint(0,3) represents the random generation of an integer from 0 to 3, bs represents the encoding of the training batch size, and the training batch size of the convolutional neural network model is 256×(bs+1); opt represents the encoding of the convolutional neural network model optimizer type, and the corresponding relationship between the opt value and the optimizer type is shown in formula (3):

[0070]

[0071] Where SGD represents the stochastic gradient descent optimizer, Adam represents the adaptive moment estimation optimizer, AdaDelta represents the improved adaptive learning rate optimizer, and Rmsprop represents the root mean square propagation optimizer. lr represents the encoding of the learning rate of the convolutional neural network model, and the learning rate of the convolutional neural network model is set to (lr+1)×2.5×10 -4 ; reg represents the encoding of the weight regularization type of the convolutional neural network model. The corresponding relationship between the reg value and the weight regularization type is shown in formula (4):

[0072]

[0073] Among them, None means that no regularization constraint is applied to the model weights, L1 means that L1 regularization constraint is applied to the weights, L2 means that L2 regularization constraint is applied to the weights, and L1∧L2 means that both L1 and L2 regularization constraints are applied to the weights.

[0074] Topo represents n×(n-1) / 2 bit binary code, which is defined as topo=[bin1,…,bin i ,…,bin n×(n-1) / 2 ],bin i =Randint(0,1), where bin iRepresents the i-th binary code in topo, and Randint(0,1) represents a random integer between 0 and 1. After generating topo, its n×(n-1) / 2-bit binary codes are assigned one by one to an upper triangular matrix A of size (n-1)×(n-1) as shown in formula (5) to represent the network topology information of the convolutional neural network model. The only starting point of the network topology is the first convolution module. For the element a in the i-th row and j-th column of A, i,j , if a i,j =1, it means that the i-th convolutional module in the network is connected to the j+1-th convolutional module, otherwise it means that there is no direct connection between the two modules;

[0075]

[0076] conv i It is composed of 5-bit integer codes and is defined as shown in formula (6):

[0077]

[0078] Where knum represents the encoding of the number of convolution kernels. The number of convolution kernels in the convolution module is 8×(knum+1); ksize represents the encoding of the convolution kernel size. The convolution kernel size in the convolution module is ksize×2+3; kact represents the encoding of the convolution kernel activation function type. The corresponding relationship between the kact value and the convolution kernel activation function in the convolution module is shown in formula (7):

[0079]

[0080] The definition of each activation function is shown in formula (8), where x represents the output value of the convolution module during forward propagation, x i represents the i-th output value in x, and a represents the slope of the Elu function in the negative part:

[0081]

[0082] pt represents the encoding of the pooling layer type of the convolution module. The corresponding relationship between the pt value and the pooling layer type in the module is shown in formula (9):

[0083]

[0084] Among them, None means that the module does not contain a pooling layer, Maxpooling means that the module contains a maximum pooling layer, and Meanpooling means that the module contains an average pooling layer; ps represents the pooling kernel size encoding. If the module contains a pooling layer, its pooling kernel size is 2×ps+3; Figure 2This is an example of a randomly generated variable-length encoding of an individual. In this example, the number of convolutional modules used to construct the CNN model is n = 4, and the encoding information of the individual is: [4, [2, 3, 5, 0], '111011', [5, 0, 2, 0, 2], [0, 0, 1, 2, 0], [5, 3, 5, 0, 0], [3, 3, 2, 0, 3]];

[0085] (4) To s N n, setting, topo, conv i Each coding position (1≤i≤n) is mutated individually in turn, and the n+3 individuals generated by each round of mutation are taken as the population S, S={s1,…,s j ,…,s n+3}, s1, s j , s n+3 They represent the first individual, the jth individual and the n+3th individual generated by the mutation, 1≤j≤n+3. The specific implementation of the mutation operation is as follows: N Each coding position in the sequence is taken as a variation site to determine the coding category of the coding position; if the coding category is n, then according to n=Randint(C L ,C H ) randomly generates an integer n, randomly generates a 4-bit integer code setting according to formula (2), randomly generates a binary code topo with a length of n×(n-1) / 2 according to formula (5), and randomly generates an integer code with a length of 5n according to formula (6) {conv i ,1≤i≤n}, the above randomly generated n, setting, topo, conv i The codes of (1≤i≤n) are combined into a new variant individual in sequence and marked as s1; if the code category is setting, a 4-bit integer code is randomly generated according to formula (2) to replace s N The original setting in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s2; if the coding type is topo, a binary code of length n×(n-1) / 2 is randomly generated to replace s N The original topo in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s3; if the encoding type is convolution module conv i (1≤i≤n), then randomly generate a 5-bit integer code according to formula (6) to replace s N The original conv i , and s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s (3+i)(1≤i≤n). Figure 3 Given the N Example diagram of successive discretization mutation operations for individual s whose encoding information is [4,[1,2,1,1],'111011',[1,2,3,2,1],[0,0,1,2,0],[5,3,5,0,0],[3,2,1,2,1]] N Each coding position is discretized and mutated in turn, resulting in 7 individuals s1, s2, s3, s4, s5, s6, s7, as the population S = {s1, s2, s3, s4, s5, s6, s7};

[0086] (5) Evaluate the performance of the population S. The specific process is as follows: Based on the architecture and parameter information of each individual representation in S, transform it into the corresponding convolutional neural network model. Figure 4 An example of transforming individual encoding information into corresponding convolutional network models and parameters is given. In this example, the encoding information of the individual is: [4, [2, 3, 5, 0], '111011', [5, 0, 2, 0, 2], [0, 0, 1, 2, 0], [5, 3, 5, 0, 0], [3, 3, 2, 0, 3]]. The offline training dataset X ot As the data input of each convolutional neural network model, TP1 rounds of offline training are performed according to the parameter information in the encoding; after the training is completed, the performance of each individual in the validation set X is counted. ov The first optimization goal f1 of each individual is f1 = (1-F1 score), and the second optimization goal f2 of each individual is calculated, that is, f2 = the number of floating-point operations per second (FLOPs) of the CNN model. The calculation formula of the F1 score is shown in formula (10):

[0087]

[0088] Where TP represents the number of abnormal power CPS data samples correctly predicted as abnormal classification, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal classification, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal classification;

[0089] (6) Perform a fast non-dominated sort on the population S and denote the Pareto frontier solution set of S as S PF , randomly from S PF Select an individual from the best ; unconditionally accept N =s best ;

[0090] (7) s best Join S Archive After that, S ArchivePerform fast non-dominated sorting and sort S Archive The Pareto frontier solution set is marked as S APF , and calculate the crowding degree of all individuals, and sort them in ascending order according to the crowding degree value. APF The number of individuals in is greater than AR max , then starting from the individual with the highest crowding degree, remove S APF Individuals with higher crowding rankings in the middle, until S APF The number of individuals in is exactly equal to AR max Individual crowding degree I d The calculation method of is: for the two individuals on the Pareto frontier, the crowding degree is positive infinity; for other individuals, the crowding degree is calculated as shown in formula (11):

[0091]

[0092] Among them, I d represents the crowding value of the dth individual, m represents the number of optimization targets, represents the fitness value of the jth target of the d+1th individual, represents the fitness value of the jth target of the d-1th individual, where 2≤d≤n+2, m=2;

[0093] (8) Unconditionally accept S Archive =S APF ;

[0094] (9) Repeat steps (4) to (8) until the set number of iterative optimization times G is met. After reaching the set number of iterative optimization times G, the Pareto frontier of the external archive solution set is as follows: Figure 5 As shown in the figure, it can be seen that the offline optimization module searches for multiple non-dominated candidate individuals that balance model performance (1-F1 score) and model complexity (floating point operations per second, FLOPs, with megabytes or millions as counting units);

[0095] (10) The optimal archive solution set S finally obtained from the offline optimization training module Archive Select an individual closest to the lower left corner in the Pareto frontier, build the optimal CNN model based on the optimal architecture and hyperparameter information represented by the individual, and use the offline training dataset X ot As the data input of the optimal CNN model, and perform TP2 rounds of offline training;

[0096] (11) The data acquisition module collects real-time monitoring data of power information from the power CPS, analyzes the data to obtain the reading information of each sensor, and performs standardization based on the standard score. The data is used as the online detection data set of the power CPS online intrusion detection module and is marked as X. t ;

[0097] (12) Using the online detection module of the power CPS intrusion detection, the optimal CNN model pre-trained in step (10) is deployed online to detect the online detection dataset X t Perform online intrusion detection. If an abnormal sample is detected, an intrusion detection alarm message is generated, and the performance indicators of intrusion detection such as F1 score, accuracy, precision and recall are calculated according to formulas (10), (12), (13) and (14) respectively.

[0098]

[0099]

[0100]

[0101] Where TP represents the number of abnormal power CPS data samples correctly predicted as abnormal, TN represents the number of normal power CPS data samples correctly predicted as normal, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal. In this embodiment, the performance indicators obtained by the technology of the present invention are: accuracy = 0.9909, F1 score = 0.9912, precision = 0.9915, recall = 0.9922, and model floating point operations per second FLOPs = 0.0544 million.

[0102] By comparing and analyzing the experimental results of the above embodiments using the technology of the present invention and the prior art, Figure 6 shown. Figure 6A comparison chart of the technology of the present invention and the existing single-objective CNN architecture and parameter parallel optimization technology based on genetic algorithm (Synchronous Optimization of Parameters and Architectures by Genetic Algorithm with CNN Blocks, abbreviated as SOPA-GA-CNN) in terms of power CPS intrusion detection performance indicators and model complexity is given, wherein sub-graph (a) is a comparison chart of the technology of the present invention and the existing SOPA-GA-CNN technology in terms of four performance indicators: F1 score, accuracy, precision and recall rate; sub-graph (b) is a comparison chart of the technology of the present invention and the SOPA-GA-CNN technology in terms of floating-point operations per second (FLOPs) indicator, and the unit of FLOPs is one million. Figure 6 It is not difficult to find that the accuracy, F1 score, precision and recall rate of the power CPS intrusion detection performance indicators obtained by the technology of the present invention are better than the existing SOPA-GA-CNN technology, and the number of floating-point operations per second required to obtain the model of the technology of the present invention is significantly lower than the existing SOPA-GA-CNN technology. Therefore, the technology of the present invention better achieves the trade-off optimization of CPS intrusion detection performance and model complexity than the existing single-target SOPA-GA-CNN technology, and is easier to realize the online deployment and online monitoring of power CPS intrusion detection. In addition, compared with the fixed-length fixed-length coding adopted by the existing SOPA-GA-CNN technology, the technology of the present invention adopts variable-length variable-length coding technology, which can better realize the automatic optimization design of the CNN model and has better flexibility; compared with the optimization technology based on population evolution adopted in the offline optimization training stage of the existing SOPA-GA-CNN technology, the multi-objective discrete optimization technology adopted by the technology of the present invention is essentially an optimization technology based on individual evolution, which requires lower computational cost, fewer computing resources, and is easier to implement in engineering and promote application.

[0103] In addition, compared with other existing technologies that rely on manual design experience, the technology of the present invention realizes the multi-objective parallel optimization of the variable-length CNN model architecture and hyperparameters suitable for power CPS intrusion detection and the automatic design of the model, thereby improving the intelligent design level and design efficiency of the power CPS intrusion detection system, and reducing the complexity of the model while ensuring the high-precision performance indicators of the model.

[0104] As described in the summary, the beneficial effects of this patent are: compared with the existing technology, the present invention can realize the variable-length CNN model architecture and multi-objective parallel optimization of hyperparameters and automatic design of the model suitable for power CPS intrusion detection, which greatly reduces the dependence on the manual design experience of designers and engineers, improves the intelligent design level and design efficiency of power CPS intrusion detection, and reduces the complexity of the model while ensuring the high-precision performance indicators of the model, and also promotes and expands the promotion and application of automatic deep learning technology in the field of ensuring the safety of power CPS.

Claims

1. A power CPS intrusion detection system based on multi-objective variable-length CNN discrete optimization, characterized by: The system includes a data acquisition module, an offline optimization training module and an online detection module for power CPS intrusion detection; The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs normalization processing based on the standard score to obtain an offline training data set, which is input into the offline optimization training module of the power CPS intrusion detection; Collect real-time monitoring data of power information from the power CPS, parse the data to obtain the reading information of each sensor, and perform standardization based on standard scores to obtain an online detection data set, which is then input into the online detection module of power CPS intrusion detection; The offline optimization training module of the power CPS intrusion detection is based on a multi-objective variable-length convolutional neural network parallel discrete optimization platform. The number of convolution modules, model topology, architectural parameters and batch size of each convolution module, learning rate, optimizer type, and weight regularization hyperparameters for constructing the variable-length CNN model are discretely encoded. The (1-F1 score) index of the CNN model on the validation set and the number of model floating-point operations are used as optimization targets. A multi-objective discrete optimization method is used to parallel optimize the CNN model architecture and parameters based on the variable-length convolution module, thereby obtaining the architecture and hyperparameter information of the Pareto optimal CNN model that takes into account both model performance and model complexity, constructing a Pareto optimal CNN model, performing pre-training, and transmitting the pre-trained optimal CNN model to the online detection module; wherein, parameter values ​​based on the multi-objective variable-length CNN parallel discrete optimization platform are set, and the parameter values ​​include the number of iterative optimizations G of the multi-objective parallel optimization of the variable-length CNN model architecture and hyperparameters, the maximum size AR of the optimal external archive solution set, and the number of iterations G of the multi-objective parallel optimization of the variable-length CNN model architecture and hyperparameters, and the maximum size AR of the optimal external archive solution set. max , the lower limit of the number of convolution modules of the CNN model C L , the upper limit of the number of convolution modules of the CNN model C H , the variable-length CNN model architecture and hyperparameter multi-objective parallel optimization phase, offline training round TP1 and test phase offline training round TP2, initialize the optimal external archive solution set S Archive is an empty set; The power CPS intrusion detection online detection module is based on the pre-trained optimal CNN model, and performs online deployment of the optimal CNN model. If an intrusion sample is detected, an alarm message is generated and the intrusion detection performance index is evaluated.

2. A power CPS intrusion detection method based on multi-objective variable-length CNN discrete optimization using the system of claim 1, characterized in that: The following steps are involved: (1) The data acquisition module of the power CPS intrusion detection collects historical monitoring data of power information from the power CPS. After data analysis, the reading information of each sensor of the power CPS is obtained to obtain the source data set, which is marked as X. For all samples in X, the standard score is normalized according to formula (1) to obtain the offline training data set, which is marked as X. o , input into the offline optimization training module of power CPS intrusion detection based on multi-objective variable-length CNN parallel discrete optimization platform, and convert X o Split into training set X in a ratio of 9:1 ot With the validation set X ov ; Among them, X oj Represents the offline training dataset X o The feature of the jth dimension, X j Represents the feature of the j-th dimension of the source dataset X, μ j represents the mean of the j-th dimension feature of X, σ j represents the standard deviation of the j-th dimension feature of X, and d represents the maximum value of the feature dimension of X; (2) In C L to C H A random individual is generated within the range and marked as s N , which represents the architecture and hyperparameter information of the variable-length CNN model, s N The encoding form is s N ={n,setting,topo,conv1,…,conv i ,…,conv n }, n represents the number of convolutional modules in the model, n = Randint(C L ,C H ), where Randint(C L ,C H ) means randomly generating a range in [C L ,C H ] integer, setting represents the training parameters of the convolutional neural network model, topo represents the topological parameters of the convolutional neural network model, conv i Represents the parameters of the i-th convolution module, 1≤i≤n; setting is composed of 4-bit integer code, and its definition is shown in formula (2): Where Randint represents the random integer generation function, Randint(0,3) represents the random generation of an integer from 0 to 3, bs represents the encoding of the training batch size, and the training batch size of the convolutional neural network model is 256×(bs+1); opt represents the encoding of the convolutional neural network model optimizer type, and the corresponding relationship between the opt value and the optimizer type is shown in formula (3): Where SGD represents the stochastic gradient descent optimizer, Adam represents the adaptive moment estimation optimizer, AdaDelta represents the improved adaptive learning rate optimizer, and Rmsprop represents the root mean square propagation optimizer; lr represents the encoding of the learning rate of the convolutional neural network model, and the learning rate of the convolutional neural network model is set to (lr+1)×2.5×10 -4 ; reg represents the encoding of the weight regularization type of the convolutional neural network model. The corresponding relationship between the reg value and the weight regularization type is shown in formula (4): Among them, None means that no regularization constraint is applied to the model weights, L1 means that L1 regularization constraint is applied to the weights, L2 means that L2 regularization constraint is applied to the weights, and L1∧L2 means that both L1 and L2 regularization constraints are applied to the weights. Topo represents n×(n-1) / 2 bit binary code, which is defined as topo=[bin1,…,bin i ,…,bin n×(n-1) / 2 ],bin i =Randint(0,1), where bin i Represents the i-th binary code in topo, Randint(0,1) represents the random generation of an integer between 0 and 1; after generating topo, its n×(n-1) / 2-bit binary codes are assigned one by one to an upper triangular matrix A of size (n-1)×(n-1) as shown in formula (5) to represent the network topology information of the convolutional neural network model; the only starting point of the network topology is the first convolution module, and the element a in the i-th row and j-th column of A is i,j , if a i,j =1, it means that the i-th convolutional module in the network is connected to the j+1-th convolutional module, otherwise it means that there is no direct connection between the two modules; conv i It is composed of 5-bit integer codes and is defined as shown in formula (6): Where knum represents the encoding of the number of convolution kernels. The number of convolution kernels in the convolution module is 8×(knum+1); ksize represents the encoding of the convolution kernel size. The convolution kernel size in the convolution module is ksize×2+3; kact represents the encoding of the convolution kernel activation function type. The corresponding relationship between the kact value and the convolution kernel activation function in the convolution module is shown in formula (7): The definition of each activation function is shown in formula (8), where x represents the output value of the convolution module during forward propagation, x i represents the i-th output value in x, and a represents the slope of the Elu function in the negative part: pt represents the encoding of the pooling layer type of the convolution module. The corresponding relationship between the pt value and the pooling layer type in the module is shown in formula (9): Among them, None means that the module does not contain a pooling layer, Maxpooling means that the module contains a maximum pooling layer, and Meanpooling means that the module contains an average pooling layer; ps represents the pooling kernel size encoding. If the module contains a pooling layer, its pooling kernel size is 2×ps+3; (3) For s N n, setting, topo, conv i Each coding position (1≤i≤n) is mutated individually in turn, and the n+3 individuals generated by each round of mutation are taken as the population S, S={s1,…,s j ,…,s n+3 }, s1, s j , s n+3 They represent the first individual, the jth individual and the n+3th individual generated by the mutation, 1≤j≤n+3; the specific implementation of the mutation operation is as follows: N Each coding position in the sequence is taken as a variation site to determine the coding category of the coding position; if the coding category is n, then according to n=Randint(C L ,C H ) randomly generates an integer n, randomly generates a 4-bit integer code setting according to formula (2), randomly generates a binary code topo with a length of n×(n-1) / 2 according to formula (5), and randomly generates an integer code with a length of 5n according to formula (6) {conv i ,1≤i≤n}, the above randomly generated n, setting, topo, conv i The codes of (1≤i≤n) are combined into a new variant individual in sequence and marked as s1; if the code category is setting, a 4-bit integer code is randomly generated according to formula (2) to replace s N The original setting in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s2; if the coding type is topo, a binary code of length n×(n-1) / 2 is randomly generated to replace s N The original topo in s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s3; if the encoding type is convolution module conv i (1≤i≤n), then randomly generate a 5-bit integer code according to formula (6) to replace s N The original conv i , and s N The other coding bits in remain unchanged, thus generating a new variant individual, which is marked as s (3+i) (1≤i≤n); (4) The performance of the population S is evaluated. The specific process is as follows: Based on the architecture and parameter information of each individual representation in S, it is converted into the corresponding convolutional neural network model, and the offline training dataset X is converted into ot As the data input of each convolutional neural network model, TP1 rounds of offline training are performed according to the parameter information in the encoding; after the training is completed, the performance of each individual in the validation set X is counted. ov The first optimization goal f1 is f1 = (1-F1 score), and the second optimization goal f2 of each individual is calculated, that is, f2 = the number of floating-point operations of the CNN model; the calculation formula of the F1 score is shown in formula (10): Where TP represents the number of abnormal power CPS data samples correctly predicted as abnormal classification, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal classification, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal classification; (5) Perform a fast non-dominated sort on the population S and denote the Pareto frontier solution set of S as S PF , randomly from S PF Select an individual from the best ; unconditionally accept N =s best ; (6) s best join in S Archive Afterwards, S Archive Perform fast non-dominated sorting and S Archive The Pareto frontier solution set is marked as S APF , and calculate the crowding degree of all individuals, and sort them in ascending order according to the crowding degree value; if S APF The number of individuals in is greater than AR max , then starting from the individual with the highest crowding degree, remove S APF Individuals with higher crowding rankings in the middle, until S APF The number of individuals in is exactly equal to AR max Individual crowding degree I d The calculation method of is: for the two individuals on the Pareto frontier, the crowding degree is positive infinity; for other individuals, the crowding degree is calculated as shown in formula (11): Among them, I d represents the crowding value of the dth individual, m represents the number of optimization targets, represents the fitness value of the jth target of the d+1th individual, represents the fitness value of the jth target of the d-1th individual, where 2≤d≤n+2, m=2; (7) Unconditionally accept S Archive =S APF ; (8) Repeat steps (3) to (7) until the set number of iterative optimization times G is met; (9) The optimal external archive solution set S finally obtained from the offline optimization training module Archive Select an individual closest to the lower left corner in the Pareto frontier, build the optimal CNN model based on the optimal architecture and hyperparameter information represented by the individual, and use the offline training dataset X ot As the data input of the optimal CNN model, and perform TP2 rounds of offline training; (10) The data acquisition module collects real-time monitoring data of power information from the power CPS, parses the data to obtain the reading information of each sensor, and performs standardization based on the standard score, which is used as the online detection data set of the online intrusion detection module and marked as X. t ; (11) Using the online detection module of the power CPS intrusion detection, the optimal CNN model pre-trained in step (9) is deployed online to detect the online detection dataset X t Perform online intrusion detection. If an abnormal sample is detected, an intrusion detection alarm message is generated, and the F1 score, accuracy, precision, and recall performance indicators of intrusion detection are calculated according to formulas (10), (12), (13), and (14) respectively; Among them, TP represents the number of abnormal power CPS data samples correctly predicted as abnormal classification, TN represents the number of normal power CPS data samples correctly predicted as normal classification, FP represents the number of normal power CPS data samples incorrectly predicted as abnormal classification, and FN represents the number of abnormal power CPS data samples incorrectly predicted as normal classification.

Images