Turbine network intrusion detection method based on bidirectional generative adversarial network with bilateral features
By using a bidirectional generative adversarial network based on two-sided features, combining features from both the physical and network sides of the steam turbine, the problem of low detection accuracy in existing technologies is solved, achieving efficient detection of various network attacks with high detection accuracy and robustness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANJING UNIV OF SCI & TECH
- Filing Date
- 2023-03-09
- Publication Date
- 2026-05-12
AI Technical Summary
Existing methods for detecting network intrusions in steam turbines fail to effectively combine physical and network characteristics, resulting in low detection accuracy and an inability to effectively respond to various network attacks.
A bidirectional generative adversarial network based on two-sided features is adopted. By analyzing and extracting features from the physical side and network layer of the steam turbine, an intrusion detection feature set is constructed. The bidirectional generative adversarial network with a moving exponential average is generated and trained to detect intrusion behavior of the steam turbine network.
It improves the detection accuracy of various attacks such as denial-of-service attacks, fake data injection attacks, and replay attacks, and enhances the robustness of the detection algorithm through the exponential moving average method.
Smart Images
Figure CN116260647B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of power grid technology, and particularly to the field of steam turbine network security, specifically a bidirectional generative adversarial network (GAN) method for detecting intrusions into steam turbine networks based on two-sided features. Background Technology
[0002] With the widespread application of communication equipment in steam turbines of thermal power plants, steam turbines are gradually becoming cyber-physical systems (CPS) integrating communication and control. However, while various communication devices have improved the control performance of steam turbines, they have also made them targets for cyberattacks, threatening the safe operation of steam turbines. Various types of cyberattacks have begun to infiltrate steam turbine control systems, posing a potential threat to the safe and stable operation of power plants and even the power grid.
[0003] The existence of these potential cyberattacks could pose a series of security risks to steam turbine systems. Therefore, it is necessary to research a steam turbine network security anomaly detection algorithm. Current methods for handling anomaly detection include the local anomaly factor method, the isolated forest method, and the autoencoder method. However, all these methods require actual operating data from the power plant, and existing methods often only consider network-side data while neglecting the physical data of the steam turbine operation, which significantly reduces the accuracy of detection. Summary of the Invention
[0004] The purpose of this invention is to address the problems existing in the prior art by providing a bidirectional generative adversarial network (GAN) intrusion detection method for steam turbine networks based on two-sided features.
[0005] The technical solution to achieve the objective of this invention is: a method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks with two-sided features, the method comprising the following steps:
[0006] Step 1: Use data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set;
[0007] Step 2: Generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network;
[0008] Step 3: Train a bidirectional generative adversarial network based on the intrusion detection feature set;
[0009] Step 4: Detect turbine network intrusion behavior based on the trained bidirectional generative adversarial network.
[0010] Furthermore, step 1 involves using data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set. The specific process includes:
[0011] Step 1-1, select the physical characteristics of the steam turbine as shown in Table 1 below:
[0012] Table 1. Physical Side Data Characteristics
[0013]
[0014] Steps 1-2, select the turbine network-side features as shown in Table 2 below:
[0015] Table 2 Network-side data characteristics table
[0016]
[0017]
[0018] Steps 1-3: Collect actual data for each feature in Tables 1 and 2;
[0019] Steps 1-4: Calculate the correlation between the data in steps 1-3, and filter out features in the feature table whose similarity is higher than a preset threshold.
[0020] Steps 1-5 involve normalizing the feature data filtered in steps 1-4, then selecting features that conform to a normal distribution to form the final intrusion detection feature set.
[0021] Furthermore, in step 2, a bidirectional generative adversarial network with a moving exponential average is generated based on the generative adversarial network. The specific process includes:
[0022] Step 2-1, construct the bidirectional generative adversarial network model as follows:
[0023]
[0024] In the formula, G represents the generator network, E represents the encoder network, D represents the discriminator network, G(*) represents the forward computation of the generator network, E(*) represents the forward computation of the encoder network, D(*) represents the forward computation of the discriminator network, x represents the original input data of the neural network, p(x) represents the probability distribution of the original input data, and z represents the generator input data, i.e., the latent space data; p E (·|x) represents the probability distribution of the encoder output given the original input data and encoder network parameters; p(z) represents the probability distribution of the latent space data; p G (·|z) represents the probability distribution of the generator output given the input data and the generator network parameters are fixed;
[0025] Loss function D during iterative optimization of network parameters D loss for:
[0026]
[0027] in,
[0028]
[0029] In the formula, sigmoid() is the activation function; D(z,G(z)) is the output calculated by the discriminator for the generator input-output data pair;
[0030]
[0031] In the formula, D(E(x),x) is the output calculated by the discriminator for the encoder input-output data pair;
[0032] The loss functions for iteratively optimizing the parameters of the G network and the E network are loss G loss E :
[0033]
[0034]
[0035] Step 2-2: When training the bidirectional generative adversarial network, add an exponential moving average (EMA) to the time axis:
[0036]
[0037] In the formula, x n The value is the nth data point in the sequence; N is the period of the exponential moving average (EMA). N (x n-1 ), EMA N (x n The results are the exponential moving average calculations performed at the (n-1)th and nth data points of the sequence, respectively, with a calculation period of N.
[0038] Simultaneously, during the training of the bidirectional generative adversarial network, a shadow variable v is created. t Smoothing neural network model parameters;
[0039] The update and change methods for neural network weights and bias parameters are as follows:
[0040] v t =β×v t-1 +(1-β)×θ t
[0041] In the formula, v t v t-1 θ represents the values of the variable to be averaged at time step t and time step t-1, respectively; β represents the weight, the larger the β, the more correlated the value after the moving average is with the historical value, and vice versa; tThis represents the value of the variable at time step t when the moving average model is not used.
[0042] Furthermore, step 3, which involves training a bidirectional generative adversarial network based on an intrusion detection feature set, specifically includes the following process:
[0043] Step 3-1: Based on the intrusion detection feature set obtained in Step 1, obtain the feature dataset during normal communication of the steam turbine;
[0044] Step 3-2: Using the feature dataset obtained in Step 3-1 as input, the bidirectional generative adversarial network in Step 2 is trained using an adaptive gradient algorithm to obtain a bidirectional generative adversarial network whose neural network parameters meet the requirements of network intrusion detection.
[0045] Step 3-3: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset of normal turbine communication and when network intrusion occurs;
[0046] Step 3-4: Use the feature dataset obtained in Step 3-3 as input to the bidirectional generative adversarial network trained in Step 3-2, obtain the network output, and calculate the anomaly score of the input. The calculation formula is as follows:
[0047] A=(1-w)*gen_score+w*dis_score
[0048] In the formula, A represents the anomaly score, w is the weight, and gen_score and dis_score are the generator reconstruction error score and the discriminator discrimination score, respectively, and their expressions are as follows:
[0049]
[0050] Steps 3-5: Repeat steps 3-3 to 3-4 to obtain several sets of abnormal scores;
[0051] Steps 3-6: Calculate the recall rate for anomaly detection.
[0052]
[0053] In the formula, TP indicates that the input itself is abnormal traffic and is correctly classified as abnormal traffic; FN indicates that the input itself is normal traffic and is incorrectly classified as abnormal traffic.
[0054] Steps 3-7: Obtain the anomaly score with the highest recall rate and use it as the anomaly detection threshold.
[0055] Furthermore, step 4, which involves detecting intrusion behavior into the turbine network based on the trained bidirectional generative adversarial network, specifically includes the following process:
[0056] Step 4-1: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset during turbine communication in real time;
[0057] Step 4-2: Use the feature dataset obtained in Step 4-1 as input to the bidirectional generative adversarial network, and calculate the anomaly score in the manner described in Step 3-4.
[0058] Step 4-3: Determine the relationship between the anomaly score in Step 4-2 and the anomaly detection threshold described in Step 3-7. If the anomaly score is greater than the anomaly detection threshold, it indicates that there is a turbine network intrusion behavior; otherwise, it indicates that there is no turbine network intrusion behavior.
[0059] Compared with the prior art, the significant advantages of this invention are:
[0060] 1) It fully considers the characteristic data of the physical side and network side during the operation of the steam turbine, and has a high detection accuracy for various attacks such as denial-of-service attacks, fake data injection attacks, and replay attacks.
[0061] 2) The detection algorithm of this invention introduces the exponential moving average method, which makes the detection algorithm have a certain degree of robustness.
[0062] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description
[0063] Figure 1 This is a flowchart of the bidirectional generative adversarial network intrusion detection method for steam turbine networks based on two-sided features, according to the present invention.
[0064] Figure 2 A simplified schematic diagram of the DEH system networking model for steam turbines.
[0065] Figure 3 A flowchart for constructing two-sided features for anomaly detection of intrusion into a steam turbine network.
[0066] Figure 4 This is a diagram showing the overall structure of a bidirectional generative adversarial network model.
[0067] Figure 5 This is a schematic diagram of the internal structure of encoder E, generator G, and discriminator D.
[0068] Figure 6 This is a graph showing the convergence of the loss in the generator module. Detailed Implementation
[0069] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0070] It should be noted that if the embodiments of the present invention involve descriptions such as "first" and "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.
[0071] In one embodiment, combined Figure 1 and Figure 3 This paper presents a method for intrusion detection in steam turbine networks based on bidirectional generative adversarial networks with two-sided features, comprising the following steps:
[0072] Step 1: Use data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set;
[0073] Step 2: Generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network;
[0074] Step 3: Train a bidirectional generative adversarial network based on the intrusion detection feature set;
[0075] Step 4: Detect turbine network intrusion behavior based on the trained bidirectional generative adversarial network.
[0076] Furthermore, in one embodiment, step 1 involves using data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set. The specific process includes:
[0077] Step 1-1, select the physical characteristics of the steam turbine as shown in Table 3 below:
[0078] Table 3. Physical Side Data Characteristics Table
[0079]
[0080] Steps 1-2, select the turbine network-side features as shown in Table 4 below:
[0081] Table 4 Network-side data characteristics table
[0082]
[0083]
[0084] Steps 1-3: Collect actual data for each feature in Tables 3 and 4;
[0085] Steps 1-4: Calculate the correlation between the data in steps 1-3, and filter out features in the feature table whose similarity is higher than a preset threshold.
[0086] Steps 1-5 involve normalizing the feature data filtered in steps 1-4, then selecting features that conform to a normal distribution to form the final intrusion detection feature set.
[0087] Preferably, the correlation in steps 1-4 is measured using Pearson correlation, and the formula for calculating Pearson correlation is:
[0088]
[0089] Where X and Y are any two features in the feature label.
[0090] Preferably, in steps 1-5, the feature data after screening in steps 1-4 are normalized by Yeo-Johnson normal transformation, and features that conform to the normal distribution are screened out by KS test.
[0091] The formula for the Yeo-Johnson normal transform is:
[0092]
[0093] The parameter λ is determined by the maximum likelihood estimation.
[0094] The formula for the KS test is:
[0095] D n =max|F exp (x)-F obs |
[0096] Where Fexp(x) is the empirical distribution function and Fobs is the target distribution function.
[0097] By comparing the p-values of the features after the Yeo-Johnson transform using the KS test, features that better conform to the normal distribution are selected for use in the subsequent neural network input construction. Finally, network features that better conform to the normal distribution are selected as the input of the neural network.
[0098] Furthermore, in one embodiment, the bidirectional generative adversarial network (GAN) algorithm uses data pairs as input to the discriminator. In a standard GAN, the discriminator aims to determine whether the input is real data. However, in a bidirectional GAN, the discrimination criteria include a part to be judged equal in size to the real vector, and latent space features extracted by the encoder E from the real vector. When the input is a fake vector generated by the generator, these latent space features are the original random distribution z used to generate the fake vector. In the generator stage, the generator G generates a target vector in the target space that is as close as possible to the real value from the random input in the latent space. Simultaneously, the encoder E encodes the input vector in the original space to generate E(x) and projects it into the latent space. During this process, the encoder gradually learns the features generated by the generator G, thus verifying whether the fake vector generated by the generator can be recognized by the discriminator.
[0099] Based on this, step 2 involves generating a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network. The specific process includes:
[0100] Step 2-1, construct the bidirectional generative adversarial network model as follows:
[0101]
[0102] In the formula, G represents the generator network, E represents the encoder network, D represents the discriminator network, G(*) represents the forward computation of the generator network, E(*) represents the forward computation of the encoder network, D(*) represents the forward computation of the discriminator network, x represents the original input data of the neural network, p(x) represents the probability distribution of the original input data, and z represents the generator input data, i.e., the latent space data; p E (·|x) represents the probability distribution of the encoder output given the original input data and encoder network parameters; p(z) represents the probability distribution of the latent space data; p G (·|z) represents the probability distribution of the generator output given the generator input data and generator network parameters are fixed.
[0103] The overall structure of the neural network and the internal structure of its three sub-neural networks are as follows: Figure 4 and Figure 5 As shown.
[0104] Loss function D during iterative optimization of network parameters D loss for:
[0105]
[0106] in,
[0107]
[0108] In the formula, sigmoid() is the activation function; D(z,G(z)) is the output calculated by the discriminator for the generator input-output data pair;
[0109]
[0110] In the formula, D(E(x),x) is the output calculated by the discriminator for the encoder input-output data pair;
[0111] The loss functions for iteratively optimizing the parameters of the G network and the E network are loss G loss E :
[0112]
[0113]
[0114] Step 2-2: When training the bidirectional generative adversarial network, add an exponential moving average (EMA) to the time axis:
[0115]
[0116] In the formula, x n The value is the nth data point in the sequence; N is the period of the exponential moving average (EMA). N (x n-1 ), EMA N (x n The results are the exponential moving average calculations performed at the (n-1)th and nth data points of the sequence, respectively, with a calculation period of N.
[0117] Simultaneously, during the training of the bidirectional generative adversarial network, a shadow variable v is created. t Smoothing neural network model parameters;
[0118] The update and change methods for neural network weights and bias parameters are as follows:
[0119] v t =β×v t-1 +(1-β)×θ t
[0120] In the formula, v t v t-1 θ represents the values of the variable to be averaged at time step t and time step t-1, respectively; β represents the weight, the larger the β, the more correlated the value after the moving average is with the historical value, and vice versa; t This represents the value of the variable at time step t when the moving average model is not used.
[0121] Furthermore, in one embodiment, step 3, training the bidirectional generative adversarial network based on the intrusion detection feature set, specifically includes the following process:
[0122] Step 3-1: Based on the intrusion detection feature set obtained in Step 1, obtain the feature dataset during normal communication of the steam turbine;
[0123] Step 3-2: Using the feature dataset obtained in Step 3-1 as input, the bidirectional generative adversarial network (GAN) from Step 2 is trained using an adaptive gradient algorithm to obtain a GAN whose neural network parameters meet the requirements of network intrusion detection. The loss function curve of the generator model during training is shown in the figure. Figure 6 As shown;
[0124] Step 3-3: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset of normal turbine communication and when network intrusion occurs;
[0125] Step 3-4: Use the feature dataset obtained in Step 3-3 as input to the bidirectional generative adversarial network trained in Step 3-2, obtain the network output, and calculate the anomaly score of the input. The calculation formula is as follows:
[0126] A=(1-w)*gen_score+w*dis_score
[0127] In the formula, A represents the anomaly score, w is the weight, and gen_score and dis_score are the generator reconstruction error score and the discriminator discrimination score, respectively, and their expressions are as follows:
[0128]
[0129] Steps 3-5: Repeat steps 3-3 to 3-4 to obtain several sets of abnormal scores;
[0130] Steps 3-6: Calculate the recall rate for anomaly detection.
[0131]
[0132] In the formula, TP indicates that the input itself is abnormal traffic and is correctly classified as abnormal traffic; FN indicates that the input itself is normal traffic and is incorrectly classified as abnormal traffic.
[0133] Steps 3-7: Obtain the anomaly score with the highest recall rate and use it as the anomaly detection threshold.
[0134] Here, recall can be replaced by precision, weighted F1, and accuracy.
[0135]
[0136] In the formula, FP represents abnormal traffic that is incorrectly classified as normal traffic; TN represents normal traffic that is correctly classified as normal traffic.
[0137] Furthermore, in one embodiment, step 4, which involves detecting turbine network intrusion behavior based on a trained bidirectional generative adversarial network, specifically includes the following process:
[0138] Step 4-1: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset during turbine communication in real time;
[0139] Step 4-2: Use the feature dataset obtained in Step 4-1 as input to the bidirectional generative adversarial network, and calculate the anomaly score in the manner described in Step 3-4.
[0140] Step 4-3: Determine the relationship between the anomaly score in Step 4-2 and the anomaly detection threshold described in Step 3-7. If the anomaly score is greater than the anomaly detection threshold, it indicates that there is a turbine network intrusion behavior; otherwise, it indicates that there is no turbine network intrusion behavior.
[0141] In one embodiment, a two-way generative adversarial network (GAN) intrusion detection system for a steam turbine network based on two-sided features is provided, the system comprising:
[0142] The first module is used to use data analysis methods to filter and extract features from the physical side and network layer of the steam turbine, and to construct an intrusion detection feature set.
[0143] The second module is used to generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network.
[0144] The third module is used to train a bidirectional generative adversarial network based on an intrusion detection feature set.
[0145] The fourth module is used to detect intrusion behavior into the steam turbine network based on the trained bidirectional generative adversarial network.
[0146] Specific limitations regarding the two-sided feature-based bidirectional generative adversarial network (GAN) intrusion detection system for steam turbine networks can be found in the limitations of the two-sided feature-based GAN intrusion detection method for steam turbine networks described above, and will not be repeated here. Each module in the aforementioned two-sided feature-based GAN intrusion detection system for steam turbine networks can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.
[0147] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:
[0148] Step 1: Use data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set;
[0149] Step 2: Generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network;
[0150] Step 3: Train a bidirectional generative adversarial network based on the intrusion detection feature set;
[0151] Step 4: Detect turbine network intrusion behavior based on the trained bidirectional generative adversarial network.
[0152] For specific limitations on each step, please refer to the limitations of the bidirectional generative adversarial network intrusion detection method for steam turbine networks based on bilateral features mentioned above, which will not be repeated here.
[0153] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0154] Step 1: Use data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set;
[0155] Step 2: Generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network;
[0156] Step 3: Train a bidirectional generative adversarial network based on the intrusion detection feature set;
[0157] Step 4: Detect turbine network intrusion behavior based on the trained bidirectional generative adversarial network.
[0158] For specific limitations on each step, please refer to the limitations of the bidirectional generative adversarial network intrusion detection method for steam turbine networks based on bilateral features mentioned above, which will not be repeated here.
[0159] As a specific example, the invention will be further described in detail in one embodiment.
[0160] (1) Example Scenarios
[0161] To more realistically simulate network attack scenarios in actual engineering environments, this embodiment uses the RT-LAB real-time simulation platform to perform real-time simulation of the steam turbine system. The simulation objective is to build a system that conforms to... Figure 2The turbine operation network model shown is used to obtain the experimental dataset required for verifying the turbine network intrusion anomaly detection algorithm.
[0162] A simulation platform was used for data acquisition and preprocessing. First, separate physical side and network traffic side data were obtained. Then, the dual-sided feature construction method proposed in this invention was used to merge the physical side and network traffic side features to generate an experimental dataset with dual-sided feature vectors.
[0163] Table 5. Information on the number of samples in the training and test sets.
[0164]
[0165] Three EMA-BIGAN networks with different parameters were trained using training data from the physical side dataset, the network traffic side dataset, and the two-sided feature dataset, respectively. The neural networks were then tested on the corresponding test sets, and the experimental results are shown in Table 6. It can be seen that using two-sided data for turbine network intrusion detection has higher accuracy compared to using data from only one side.
[0166] Table 6 Performance Comparison of Feature Construction Methods for Anomaly Detection Datasets
[0167]
[0168] The method of this invention achieves high accuracy in detecting network intrusions in steam turbine systems, and can detect potential network attacks in steam turbine systems, thus possessing certain theoretical and engineering value.
[0169] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention without departing from its spirit and scope should be included within the protection scope of the present invention.
Claims
1. A method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks with two-sided features, characterized in that, The method includes the following steps: Step 1: Use data analysis methods to screen and extract features from the physical and network layers of the steam turbine to construct an intrusion detection feature set; Step 2: Generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network; the specific process includes: Step 2-1, construct the bidirectional generative adversarial network model as follows: In the formula, G represents the generator network, E represents the encoder network, D represents the discriminator network, G(*) represents the forward computation of the generator network, E(*) represents the forward computation of the encoder network, D(*) represents the forward computation of the discriminator network, x represents the original input data of the neural network, p(x) represents the probability distribution of the original input data, and z represents the generator input data, i.e., the latent space data. This represents the probability distribution of the encoder output given the original input data and encoder network parameters. Represents the probability distribution of latent space data; This represents the probability distribution of the generator's output given the input data and the generator network parameters. Loss function when iteratively optimizing D network parameters for: in, In the formula, For activation functions; The generator input and output data pairs are used to calculate the output through the discriminator; In the formula, The encoder input and output data pairs are used to calculate the output through the discriminator; The loss functions for iteratively optimizing the parameters of the G network and the E network are respectively , : Step 2-2: When training the bidirectional generative adversarial network, add an exponential moving average (EMA) to the time axis: In the formula, To assign a value to the nth data in the sequence; The period of the exponential moving average. , These are the results of the exponential moving average calculation performed at the (n-1)th and nth data points of the sequence, respectively, with a calculation period of N. Simultaneously, shadow variables are created during the training process of the bidirectional generative adversarial network. Smoothing neural network model parameters; The update and change methods for neural network weights and bias parameters are as follows: In the formula, , These represent the values of the variable to be averaged at time step t and time step t-1, respectively. Indicates weight, The larger the value, the more correlated it is with historical values after the moving average; conversely, the smaller the value, the more correlated it is with the current value. This represents the value of the variable at time step t when the moving average model is not used; Step 3: Train a bidirectional generative adversarial network based on the intrusion detection feature set; Step 4: Detect turbine network intrusion behavior based on the trained bidirectional generative adversarial network.
2. The method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks using two-sided features as described in claim 1, characterized in that, Step 1 describes the use of data analysis methods to screen and extract features from the physical and network layers of the steam turbine, constructing an intrusion detection feature set. The specific process includes: Step 1-1, select the physical characteristics of the steam turbine as shown in Table 1 below: Table 1. Physical side data characteristics table Steps 1-2, select the turbine network-side features as shown in Table 2 below: Table 2 Network-side data characteristics table Steps 1-3: Collect actual data for each feature in Tables 1 and 2; Steps 1-4: Calculate the correlation between the data in steps 1-3, and filter out features in the feature table whose similarity is higher than a preset threshold. Steps 1-5 involve normalizing the feature data filtered in steps 1-4, then selecting features that conform to a normal distribution to form the final intrusion detection feature set.
3. The method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks using two-sided features as described in claim 2, characterized in that, The correlation in steps 1-4 is measured by Pearson correlation.
4. The method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks using two-sided features as described in claim 2, characterized in that, In steps 1-5, the Yeo-Johnson normal transformation is used to normalize the feature data after screening in steps 1-4, and the KS test is used to screen out features that conform to the normal distribution.
5. The method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks using two-sided features as described in claim 2, characterized in that, Step 3, which involves training a bidirectional generative adversarial network based on an intrusion detection feature set, specifically includes the following process: Step 3-1: Based on the intrusion detection feature set obtained in Step 1, obtain the feature dataset during normal communication of the steam turbine; Step 3-2: Using the feature dataset obtained in Step 3-1 as input, the bidirectional generative adversarial network in Step 2 is trained using an adaptive gradient algorithm to obtain a bidirectional generative adversarial network whose neural network parameters meet the requirements of network intrusion detection. Step 3-3: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset of normal turbine communication and when network intrusion occurs; Step 3-4: Use the feature dataset obtained in Step 3-3 as input to the bidirectional generative adversarial network trained in Step 3-2, obtain the network output, and calculate the anomaly score of the input. The calculation formula is as follows: In the formula, A represents the abnormal score. As weight, and The generator reconstruction error score and the discriminator discrimination score are respectively expressed as follows: Steps 3-5: Repeat steps 3-3 to 3-4 to obtain several sets of abnormal scores; Steps 3-6: Calculate the recall rate for anomaly detection. In the formula, This indicates that the input itself is abnormal traffic and has been correctly classified as abnormal traffic; This indicates that the input itself is normal traffic, but it has been incorrectly classified as abnormal traffic; Steps 3-7: Obtain the anomaly score with the highest recall rate and use it as the anomaly detection threshold.
6. The method for detecting intrusion into a steam turbine network based on bidirectional generative adversarial networks using two-sided features according to claim 5, characterized in that, Step 4 describes the detection of turbine network intrusion behavior based on the trained bidirectional generative adversarial network. The specific process includes: Step 4-1: Based on the intrusion detection feature set obtained in Step 1, acquire the feature dataset during turbine communication in real time; Step 4-2: Use the feature dataset obtained in Step 4-1 as input to the bidirectional generative adversarial network, and calculate the anomaly score in the manner described in Step 3-4. Step 4-3: Determine the relationship between the anomaly score in Step 4-2 and the anomaly detection threshold described in Step 3-7. If the anomaly score is greater than the anomaly detection threshold, it indicates that there is a turbine network intrusion behavior; otherwise, it indicates that there is no turbine network intrusion behavior.
7. A steam turbine network intrusion detection system based on two-sided features and bidirectional generative adversarial network according to any one of claims 1 to 6, characterized in that, The system includes: The first module is used to use data analysis methods to filter and extract features from the physical side and network layer of the steam turbine, and to construct an intrusion detection feature set. The second module is used to generate a bidirectional generative adversarial network with a moving exponential average based on the generative adversarial network. The third module is used to train a bidirectional generative adversarial network based on an intrusion detection feature set. The fourth module is used to detect intrusion behavior into the steam turbine network based on the trained bidirectional generative adversarial network.
8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.