A method for detecting network threats in energy internet

Abstract

The present invention relates to a method for detecting network threats in the energy internet. The specific steps are as follows: first, a feature embedding model is pre-trained locally on a client using public internet data; then, drawing on the ideas of federated learning and transfer learning, each industrial agent uses its own industrial data to perform federated training on the pre-trained model; on this basis, an IDS deployed in each network can construct a corresponding detection model using a very small number of small sample attack samples, and then generate a final intrusion detection model, so that the final intrusion detection model can effectively detect intrusions against small sample attacks.

Description

Technical Field

[0001] The present invention relates to an energy internet network threat detection method, belonging to the technical field of network attack detection. Background Art

[0002] In production activities, efficient production and control often require the collaboration of multiple energy interconnections. For example, the National Energy Interconnection Company's operations and facilities are spread across provinces and municipalities, necessitating the establishment of multi-tiered energy interconnections within provincial and municipal companies to improve operational efficiency and fault location. However, while this distributed architecture offers benefits in terms of efficient computing, communication, and remote control, it also introduces security risks. Vast amounts of measurement and control data are aggregated and forwarded across various networks, making these networks prime targets for attackers. Centralized intrusion detection methods are often used to implement intrusion detection within the Energy Interconnection. However, these methods require the collection of massive amounts of traffic data to train models. This data collection process passes through multiple networks and intermediate devices, making it susceptible to data leaks.

[0003] In order to solve the data privacy problem of centralized intrusion detection methods in existing technologies, some scholars have proposed collaborative intrusion detection methods based on federated learning. For example, in 2021, Li B et al. proposed an intrusion detection scheme based on deep federated learning for industrial CPS (Cyber-Physical Systems) (Li B, Wu Y, Song J, et al. DeepFed: Federated deep learning for intrusion detection in industrial cyber–physical systems[J]. IEEE Transactions on Industrial Informatics, 2020, 17(8): 5615-5624). The scheme designed a detection model consisting of a gated recurrent unit, a CNN (Convolutional Neural Networks) module and an MLP module; in the same year, Li J et al. designed a federated learning architecture for mitigating DDoS (Distributed Denial of Service) attacks on the industrial Internet (Li J, Lyu L, Liu X, et al. FLEAM: A federated learning empowered architecture to mitigate DDoS in industrial IoT[J / OL]. IEEE Transactions on Industrial Informatics, 2021. http: / / dx.doi.org / 10.1109 / TII.2021.3088938.), by combining federated learning and edge computing, a distributed collaborative DDoS attack mitigation system was established; in 2020, Chen Y et al. proposed a CNN-based federated learning framework for data classification (Chen Y, Qin X, Wang J, et al. Fedhealth: A federated transfer learning framework for wearable healthcare[J]. IEEE Intelligent Systems, 2020, 35(4): 83–93.), which contains two convolutional layers, two pooling layers, two fully connected layers and a softmax (the last activation unit of the neural network) layer. These methods can effectively protect data privacy while building the model.

[0004] However, in the process of using the existing technology, the inventors found that the existing technology has at least the following problems:

[0005] These existing technologies typically assume that each network can provide sufficient labeled samples. However, in the real world of energy internet, it's not always possible to capture sufficient common attack samples. Furthermore, the combined samples captured by all energy internet networks still don't provide sufficient prior knowledge for model training. Consequently, existing technologies cannot effectively build intrusion detection models. Furthermore, the lack of labeled small samples makes existing federated learning-based approaches ineffective for building effective intrusion detection models against these attacks. Summary of the Invention

[0006] In order to solve the above problems in the prior art, the present invention proposes an energy Internet network threat detection method.

[0007] The technical solutions of the present invention are as follows:

[0008] In one aspect, the present invention provides a method for detecting network threats in an energy internet, comprising the following steps:

[0009] Constructing an initial machine learning model and obtaining a public dataset, and then pre-training the initial machine learning model using a random subset of the public dataset to obtain a pre-trained feature embedding model;

[0010] Obtaining an energy internet dataset local to the energy internet, and using the energy internet dataset to perform federated training on the pre-trained feature embedding model to obtain a federated trained feature embedding model;

[0011] Obtaining a normal sample dataset and a small sample attack dataset of a specified network intrusion type, inputting the normal sample dataset and the small sample attack dataset into the federated training feature embedding model, and generating a final intrusion detection model based on an output result of the federated training feature embedding model;

[0012] Acquiring real-time operation data of the energy internet and preprocessing the energy internet operation data to obtain preprocessed data;

[0013] The preprocessed data is input into the final intrusion detection model to obtain the energy Internet intrusion prediction result.

[0014] As a preferred embodiment of the present invention, the initial machine learning model adopts the FE-Net model.

[0015] As a preferred embodiment of the present invention, the initial machine learning model is pre-trained on the local client, and the trained model parameters are uploaded to the cloud server for storage;

[0016] The pre-trained feature embedding model is federated trained on each industrial agent, and the parameters of the pre-trained feature embedding model are aggregated by the cloud server using the FedAvg method.

[0017] As a preferred embodiment of the present invention, the specific steps of constructing the pre-trained feature embedding model are:

[0018] First, set the public dataset as

[0019] in, represents the i-th public data sample, is the characteristic vector of the i-th public data sample (x i1 ,x i2 ,…,x it ), is the label of the i-th sample, i is the serial number of the public data sample, N net is the total number of public data samples;

[0020] The public dataset carries a label type set, which is: L net ={0,1,...,l net}, tag type 0,1,...,l net In the example, 0 represents the positive label, 1,...,l net Representing different types of negative labels;

[0021] Acquire a pre-training task according to the label type of the negative label in the public dataset, and construct a pre-training dataset for the pre-training task using the public dataset;

[0022] Pre-training the initial machine learning model using the pre-training dataset of the pre-training task to obtain a loss function corresponding to the pre-training task;

[0023] The loss function corresponding to the pre-training task is used to update the model parameters in the initial machine learning model to obtain a pre-trained feature embedding model.

[0024] As a preferred embodiment of the present invention, the specific steps of using the public dataset to construct the pre-training dataset for the pre-training task are:

[0025] When the pre-training task is a pre-training task corresponding to the negative label atk, the data set consisting of all public data with label type 0 in the public data set is set as the first data set Set the data set consisting of all public data with tag type atk as the second data set

[0026] From the first data set and the second data set In the example, k public data samples are selected to obtain the support data set Ds. net ; Wherein, the supporting data set Ds net ={(x1, y1), ..., (x 2k ,y 2k )};

[0027] From the first data set The remaining public data samples except the selected k public data samples and the second data set From the remaining public data samples except the selected k public data samples, k' public data samples are selected to obtain the query data set Dq net ; Wherein, the query data set Dq net ={(x 1′ ,y 1′ ),…,(x 2k′ ,y 2k′ )};

[0028] The support dataset Ds net and the query dataset Dq net The pre-training dataset T that constitutes the pre-training task net ; Wherein, the pre-training data set T net ={Ds net , Dq net}.

[0029] As a preferred embodiment of the present invention, the pre-training dataset T of the pre-training task is used. net Pre-train the initial machine learning model to obtain the loss function corresponding to the pre-training task. The specific steps are as follows:

[0030] From the pre-training dataset T net Support dataset Ds net The sample data in (x s ,y s ), extract the first sample data set with all labels 0 Convert all non-0 labels to 1, and then extract the second sample data set with all labels 1

[0031] According to the first sample data set Get the first positive class representative vector, according to the second sample data set Get the first negative class representative vector;

[0032] Among them, the first positive class representative vector is:

[0033]

[0034] The first negative class representative vector is:

[0035]

[0036] Where, is the preset parameter of the initial machine learning model; s is the eigenvector; is x s The corresponding model represents the vector;

[0037] According to the pre-training dataset T net The query dataset Dq net The sample data in (x q ,y q ), the first positive class representative vector and the first negative class representative vector, and obtain the query data set Dq net The probability value of the sample data in being correctly predicted:

[0038]

[0039] Where: d(a, b) is the Euclidean square distance between data a and data b, x′ q and y′ q are all constants; y q The corresponding representative vector;

[0040] According to the query data set Dq net The probability value of the sample data in is correctly predicted, and the initial machine learning model is obtained for x q The loss value is:

[0041]

[0042] in: Represents x q The predictive distribution generated by the initial machine learning model, p(x q ) represents the true distribution of the sample;

[0043] According to the pre-training dataset T net The query dataset Dq net All sample data x in q The loss value of , and the loss function corresponding to the pre-training task are obtained:

[0044]

[0045]

[0046] Among them: α is a parameter used to adjust the weight of the loss function.

[0047] As a preferred embodiment of the present invention, after updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters obtained are:

[0048]

[0049] Where: γ is the weight decay rate to prevent overfitting; η is the learning rate; is the gradient of the loss function,

[0050] As a preferred embodiment of the present invention, the specific steps of constructing the federated training feature embedding model are:

[0051] Freeze the first N of the pre-trained feature embedding models frz Layer parameters, get the feature embedding model after parameter freezing;

[0052] According to the label type of the negative label of the energy internet dataset, a collaborative training task is obtained, and the energy internet dataset is used to construct a collaborative training dataset for the collaborative training task. The specific steps are as follows:

[0053] First, perform feature alignment on the Energy Internet dataset, retaining only the overlapping features among multiple features, and obtain the aligned small sample dataset:

[0054]

[0055] in: represents the i-th energy internet data sample; is the characteristic vector of the i-th energy internet data sample (x i1 ,x i2 ,…, it ), is the label of the i-th energy internet data sample, i is the sequence number of the energy internet data sample, N ind is the total number of energy internet data samples;

[0056] The energy internet dataset carries a tag type set, which is: L ind ={0, 1, ..., l ind}, tag type 0, 1, ..., l ind In the example, 0 represents the positive label, 1, ..., l ind Representing different types of negative labels;

[0057] When the collaborative training task includes a negative label, the data set consisting of all energy internet data samples with label type 0 in the energy internet data set is set as the third data set The data set consisting of all energy internet data samples with negative label type is set as the fourth data set

[0058] From the third data set and the fourth data set In the example, k energy internet data samples are selected to obtain the support dataset Ds ind ; Wherein, the supporting data set Ds ind ={(x1, y1), ..., (x 2k ,y 2k )};

[0059] From the third data set The remaining small sample data samples except the selected k small sample data samples and the fourth data set And from the remaining energy internet data samples except the selected k energy internet data samples, k' energy internet data samples are selected respectively to obtain the query data set Dq ind ; Wherein, the query data set Dq ind ={(x 1′ ,y 1′ ),…,(x 2k′ ,y 2k′ )};

[0060] The support dataset Ds ind and the query dataset Dq ind The collaborative training dataset T that constitutes the collaborative training task ind ; Wherein, the collaborative training data set T ind ={Ds ind , Dq ind};

[0061] The collaborative training dataset of the collaborative training task is used to collaboratively train the parameter-frozen feature embedding model to obtain a loss function corresponding to the collaborative training task. The specific steps are as follows:

[0062] From the collaborative training dataset T ind Support dataset Ds ind Small sample data sample (x s ,y s ), extract the third sample data set with all labels as 0 Convert all non-0 labels to 1, and then extract the fourth sample data set with all labels 1

[0063] According to the third sample data set Get the collaborative training positive class representative vector, according to the fourth sample data set Get the representative vector of the negative class for collaborative training;

[0064] The collaborative training positive class representative vector is:

[0065]

[0066] The collaborative training negative class representative vector is:

[0067]

[0068] Where, is the preset parameter of the initial machine learning model; s is the eigenvector; is x s The corresponding model represents the vector;

[0069] According to the collaborative training dataset T ind The query dataset Dq ind The sample data in (x q ,y q ), the collaborative training positive class representative vector and the collaborative training negative class representative vector, and obtain the query data set Dq ind The probability value of the sample data in being correctly predicted;

[0070]

[0071] Where: d(a, b) is the Euclidean square distance between data a and data b, x′ q and y′ q are all constants; y q The corresponding representative vector;

[0072] According to the query data set Dq ind The probability value of the sample data in is correctly predicted, and the initial machine learning model is obtained for x q The loss value is:

[0073]

[0074] in: represents the predictive distribution of xx produced by the initial machine learning model, p(x q) represents the true distribution of the sample;

[0075] According to the collaborative training dataset T ind The query dataset Dq ind All sample data x in q The loss value of , and the loss function corresponding to the collaborative training task are obtained:

[0076]

[0077]

[0078] Among them: α is the parameter used to adjust the weight of the loss function;

[0079] The loss function corresponding to the collaborative training task is used to update the model parameters in the feature embedding model after the parameters are frozen to obtain a federated training feature embedding model.

[0080] As a preferred embodiment of the present invention, the specific steps of constructing the final intrusion detection model are:

[0081] Inputting the normal sample dataset and the small sample attack dataset into the federated training feature embedding model to obtain a third positive class representative vector and a third negative class representative vector;

[0082] A final intrusion detection model is generated according to the third positive class representative vector, the third negative class representative vector and the federated training feature embedding model.

[0083] As a preferred embodiment of the present invention, the specific steps for obtaining the energy internet intrusion prediction results are:

[0084] Inputting the preprocessed data into the final intrusion detection model to obtain a feature embedding vector x′;

[0085] Get the similarity between the feature embedding vector x′ and the preset positive class representative vector And the similarity between the feature embedding vector x′ and the preset negative class representative vector

[0086] Based on similarity and similarity Obtain an energy internet intrusion prediction result; wherein the energy internet intrusion prediction result is:

[0087] The present invention has the following beneficial effects:

[0088] 1. The present invention provides an energy internet network threat detection method. Drawing on the ideas of federated learning and transfer learning, each industrial agent uses its own industrial energy internet data to perform federated training on the pre-trained model. During the training process, the data of each energy internet is always stored locally, effectively avoiding privacy leaks and other problems, and ensuring the data security of the energy internet.

[0089] 2. The present invention provides an energy internet network threat detection method, which generates a final intrusion detection model through a normal sample data set and the small sample attack data set, so that only a small number of common attack samples of the energy internet are required to provide prior knowledge. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 is a flow chart of the present invention;

[0091] Figure 2 It is a module block diagram of the FE-Net model in the present invention;

[0092] Figure 3 In the process of federated training of the present invention, the first N frz Layer parameters are frozen, and N frz =4 when the structure diagram;

[0093] Figure 4 It is a module block diagram of the system of the present invention;

[0094] Figure 5 It is a module block diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0095] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0096] It should be understood that the step numbers used herein are only for convenience of description and are not intended to limit the order in which the steps are to be executed.

[0097] It should be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0098] The terms “include” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0099] The term "and / or" refers to and includes any and all possible combinations of one or more of the associated listed items.

[0100] Example 1:

[0101] See also Figure 1 , a method for detecting network threats in energy internet, comprising the following steps:

[0102] Constructing an initial machine learning model and obtaining a public dataset, and then pre-training the initial machine learning model using a random subset of the public dataset to obtain a pre-trained feature embedding model;

[0103] Obtaining an energy internet dataset local to the energy internet, and using the energy internet dataset to perform federated training on the pre-trained feature embedding model to obtain a federated trained feature embedding model;

[0104] Obtaining a normal sample dataset and a small sample attack dataset of a specified network intrusion type, inputting the normal sample dataset and the small sample attack dataset into the federated training feature embedding model, and generating a final intrusion detection model based on an output result of the federated training feature embedding model;

[0105] Acquiring real-time operation data of the energy internet and preprocessing the energy internet operation data to obtain preprocessed data;

[0106] The preprocessed data is input into the final intrusion detection model to obtain the energy Internet intrusion prediction result.

[0107] Specifically, in this embodiment:

[0108] S1. Build an initial machine learning model and obtain a public dataset The initial machine learning model is then pre-trained using the public dataset to obtain a pre-trained feature embedding model. Specifically, the initial machine learning model in this embodiment adopts the FE-Net model. It should be noted that, given the scarcity of common attack samples in energy internet data, which may not provide sufficient prior knowledge for training the initial machine learning model, the initial machine learning model is pre-trained using a public dataset that is publicly available online during the pre-training phase to complete the initial training phase of the model.

[0109] As a preferred implementation of this embodiment, see Figure 2 , the initial machine learning model adopts the FE-Net model.

[0110] As a preferred implementation of this embodiment, the public data set is set as Any public data middle, is the feature vector of the i-th sample (x i1 , x i2 ,...,x it ), is the label of the i-th sample; the public dataset carries a label type set, and the label type set is: L net ={0, 1, ..., l net}, tag type 0, 1, ..., l net In the example, 0 represents the positive label, 1, ..., l net Represents different types of negative labels; for example, the label types are concentrated, 1 is a simple malicious response injection attack, 2 is a complex malicious response injection attack, 3 is a malicious state command injection attack, etc., which are not limited here.

[0111] As a preferred implementation of this embodiment, the initial machine learning model is pre-trained using the public dataset to obtain a pre-trained feature embedding model, including:

[0112] S101. According to the label type of the negative label in the public data set, a pre-training task is obtained, and a pre-training data set for the pre-training task is constructed using the public data set;

[0113] When the pre-training task is a pre-training task corresponding to the negative label atk, the data set consisting of all public data with label type 0 in the public data set is set as the first data set Set the data set consisting of all public data with tag type atk as the second data set Specifically, in this embodiment, the pre-training task corresponding to the negative label atk is obtained according to the label type of the negative label atk in the public dataset; the pre-training dataset T of the pre-training task is constructed using the public dataset. net ,include:

[0114] S101a. From the first data set and the second data set In the example, k sample data are selected to obtain the support data set Ds. net ; Wherein, the supporting data set Ds net={(x1, y1), ..., (x 2k ,y 2k )};

[0115] S101b. From the first data set The remaining public data outside the k sample data and the second data set In the remaining public data except k sample data, k' sample data are selected to obtain the query data set Dq net ; Wherein, the query data set Dq net ={(x1, y1), ..., (x 2k′ ,y 2k′ )};

[0116] In order to facilitate the subsequent pre-training of the initial machine learning model and the calculation of the loss function, in this embodiment, after obtaining the support data set Ds net and the query dataset Dq net Then, the support dataset Ds net and the query dataset Dq net The public data in is reshaped into a two-dimensional form. The support dataset and query dataset are represented as follows:

[0117] Ds net

[0118] ={(x 11 , x 12 ,…,x 1t ,y′1),…,(x i1 , x i2 ,…,x it , y′ i ),…,(x 2k1 , x 2k2 ,…,x 2kt , y′ 2k )}

[0119] Dq net

[0120] ={(x 11 , x 12 ,…,x 1t ,y′1),…,(x i1 , x i2 ,…,x it , y′ i ),…,(x 2k′1 , x 2k′2 ,…,x 2k′t , y′ 2k′ )}

[0121] According to the supporting dataset Dsnet The tag type set carried and the query dataset Dq net The tag type set carried by the support dataset Ds net and the query dataset Dq net All negative labels in the support dataset Ds are reset to 1; net and the query dataset Dq net In , the reset label corresponding to the i-th public data is:

[0122]

[0123] S101c. The support data set Ds net and the query dataset Dq net The pre-training dataset T that constitutes the pre-training task net ; Wherein, the pre-training data set T net ={Ds net , Dq net}.

[0124] It should be understood that, at this time, the pre-training dataset T of the pre-training task net The task tag type set carried is Where atk is 1, ..., l net Any negative label in .

[0125] S102. Pre-train the initial machine learning model using the pre-training dataset of the pre-training task to obtain a loss function corresponding to the pre-training task;

[0126] Use the pre-training dataset T of the pre-training task net Pre-training the initial machine learning model to obtain a loss function corresponding to the pre-training task includes:

[0127] S102a. From the pre-training dataset T net Support dataset Ds net The sample data in (x s ,y s ), extract the first sample data set with all labels 0 And the second sample dataset with all labels 1

[0128] S102b. According to the first sample data set Get the first positive class representative vector, according to the second sample data set Obtain a first negative class representative vector, thereby achieving the mapping between the input and output of the initial machine learning model; wherein the first positive class representative vector is: The first negative class representative vector is: Where, are the preset parameters of the initial machine learning model, is x s The corresponding model represents the vector;

[0129] At this time, the first positive class representative vector, the first negative class representative vector and the initial machine learning model together constitute the prediction model of the pre-training task;

[0130] S102c. Based on the pre-training data set T net The query dataset Dq net The sample data in (x q ,y q ), the first positive class representative vector and the first negative class representative vector, and obtain the query data set Dq net The probability value of the sample data in is correctly predicted; wherein the query data set Dq net The probability of the sample data in being correctly predicted is:

[0131]

[0132] Where: d(a, b) is the Euclidean square distance between data a and data b, x′ q and y′ q are all constants; y q The corresponding representative vector;

[0133] S102d. According to the query data set Dq net The probability value of the sample data in is correctly predicted, and the initial machine learning model is obtained for x q The loss value of x; wherein, the initial machine learning model q The loss value is:

[0134]

[0135] in: Represents x q The predictive distribution generated by the initial machine learning model, p(x q ) represents the true distribution of the sample;

[0136] S102e. Based on the pre-training data set T net The query dataset Dq net All sample data x inq The loss value of is used to obtain the loss function corresponding to the pre-training task; wherein the loss function is:

[0137]

[0138]

[0139] Among them: α is a parameter used to adjust the weight of the loss function.

[0140] S103. Using the loss function corresponding to the pre-training task, the model parameters in the initial machine learning model are updated to obtain a pre-trained feature embedding model.

[0141] Specifically, in this embodiment, after updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters obtained are:

[0142]

[0143] Where: γ is the weight decay rate to prevent overfitting; η is the learning rate; is the gradient of the loss function,

[0144] In this embodiment, multiple pre-training tasks are constructed. In the pre-training dataset T of multiple pre-training task pairs, net The initial machine learning models are pre-trained respectively, and when the value of the obtained loss function reaches a threshold, a converged pre-trained feature embedding model, that is, a converged FE-Net model, can be obtained.

[0145] S2. Obtain the local energy internet dataset of the energy internet The pre-trained feature embedding model is federated trained using the energy internet dataset to obtain a federated trained feature embedding model. Specifically, the federated training of the pre-trained feature embedding model draws on the ideas of horizontal federated learning and transfer learning. It should be noted that although the public dataset provides certain prior knowledge for model training, so that the pre-trained feature embedding model has certain feature embedding capabilities, due to the use of a large amount of public internet data for training, the pre-trained feature embedding model may be more inclined to fit the data characteristics of the public internet, so that it cannot achieve the best effect in the energy internet intrusion detection task. Therefore, this embodiment further adopts the ideas of horizontal federated learning and transfer learning for the pre-trained feature embedding model, and uses the energy internet dataset local to the energy internet to conduct federated training on the pre-trained feature embedding model, that is, by using the energy internet dataset to transfer model knowledge, so as to further obtain a federated trained feature embedding model, thereby improving the detection capability of the federated trained feature embedding model for energy internet intrusion.

[0146] Specifically, in this embodiment, the federated training feature embedding model is a global model suitable for energy Internet intrusion detection tasks.

[0147] The pre-trained feature embedding model is federated trained using the energy internet dataset to obtain a federated trained feature embedding model, including:

[0148] S201. Freeze the first N of the pre-trained feature embedding model frz Layer parameters, get the feature embedding model after parameter freezing, so that the first N frz Layer parameters do not participate in gradient descent, thus ensuring the stability of the model;

[0149] In this embodiment, Figure 3 The first N frz Layer parameters are frozen, and N frz Structural diagram when =4.

[0150] S202. Perform feature alignment processing on all data in the energy internet dataset to obtain a preprocessed energy internet dataset, so as to obtain collaborative training tasks based on the label type of the negative label of the preprocessed energy internet dataset. It should be noted that the feature alignment processing is performed on all data in the energy internet dataset, that is, only the overlapping features among multiple features are retained.

[0151] S203. According to the label type of the negative label of the energy internet dataset, a collaborative training task is obtained, and the energy internet dataset is used to construct a collaborative training dataset T for the collaborative training task. indSpecifically, in this embodiment, according to the energy internet data set and the tag type set L it carries ind ={0, ..., l ind}, a collaborative training dataset T for the pre-training task can be constructed ind ={Ds ind , Dq ind}; Among them, Ds ind and Dq ind They represent the support dataset and query dataset based on the industrial data in the Energy Internet dataset respectively;

[0152] S204. Using the collaborative training dataset T of the collaborative training task ind Performing collaborative training on the parameter-frozen feature embedding model to obtain a loss function corresponding to the collaborative training task;

[0153] S205. Using the loss function corresponding to the collaborative training task, update the model parameters in the parameter-frozen feature embedding model to obtain a federated trained feature embedding model. It should be understood that when updating the model parameters in the parameter-frozen feature embedding model, the model parameters in the parameter-frozen feature embedding model are the latest model parameters in the pre-trained feature embedding model.

[0154] Specifically, in this embodiment, according to the support data set Ds ind and query dataset Dq ind The second positive class representative vector can be calculated and the second negative class representative vector For the query dataset Dq ind Each sample data (x q ,y q ), (x q ,y q )∈Dq ind ,use and The embedding loss of the frozen feature embedding model for the sample data is calculated, and the loss function corresponding to the collaborative training task can be further obtained. Finally, the model parameters of the frozen feature embedding model are updated according to the loss function corresponding to the collaborative training task to obtain the federated training feature embedding model. The above calculation process is consistent with the calculation process in the pre-training step and will not be repeated here.

[0155] S3. Obtain a normal sample dataset and a small sample attack dataset of a specified network intrusion type The normal sample data set and the small sample attack data set are input into the federated training feature embedding model, and a final intrusion detection model is generated according to an output result of the federated training feature embedding model. Specifically, the final intrusion detection model is composed of the normal representative vector in the normal sample data set, the attack representative vector in the small sample attack data set, and the federated training feature embedding model.

[0156] Inputting the normal sample data set and the small sample attack data set into the federated training feature embedding model, and generating a final intrusion detection model according to the output result of the federated training feature embedding model, including:

[0157] S301. Input the normal sample dataset and the small sample attack dataset into the federated training feature embedding model to obtain a third positive class representative vector and a third negative class representative vector;

[0158] S302. Generate a final intrusion detection model based on the third positive class representative vector, the third negative class representative vector and the federated training feature embedding model.

[0159] As an example, using industrial agent A i Small sample attack dataset held When generating the final intrusion detection model, the small sample attack dataset Contains k positive samples and k negative samples, and the k positive samples and k negative samples are respectively input into the federated training feature embedding model to obtain the corresponding third positive representative vector and the third negative class representative vector

[0160] S4. Obtaining real-time operation data of the Energy Internet and preprocessing the Energy Internet operation data to obtain preprocessed data;

[0161] In this embodiment, when the energy internet operation data is continuous data, the energy internet operation data is preprocessed to obtain preprocessed data, including:

[0162] All features in the energy internet operation data are converted to a unified measure using a normalization method to obtain preprocessed data; wherein the hth eigenvalue of the jth column feature in the preprocessed data is for:

[0163]

[0164] in: is the hth eigenvalue of the jth column feature in the energy internet operation data, is the maximum eigenvalue of the j-th column feature in the energy internet operation data, is the minimum eigenvalue of the j-th column feature in the energy internet operation data;

[0165] When the energy internet operation data is discrete data, preprocessing the energy internet operation data to obtain preprocessed data includes:

[0166] The energy internet operation data is processed using one-hot encoding to obtain preprocessed data. It should be noted that, assuming that a discrete feature column in the energy internet operation data contains N different values, after one-hot encoding, each value of the energy internet operation data is encoded as a unique vector consisting of N-1 "0s" and one "1".

[0167] S5. Input the preprocessed data into the final intrusion detection model to obtain the energy Internet intrusion prediction result.

[0168] Inputting the pre-processed data into the final intrusion detection model to obtain the energy internet intrusion prediction results, including:

[0169] S501. Input the preprocessed data into the final intrusion detection model to obtain a feature embedding vector x′;

[0170] S502. Obtain the similarity between the feature embedding vector x′ and the preset positive class representative vector And the similarity between the feature embedding vector x′ and the preset negative class representative vector Specifically, in this embodiment, the preset positive class representative vector can be but is not limited to the first positive class representative vector or the second positive class representative vector, and the preset negative class representative vector can be but is not limited to the first negative class representative vector or the second negative class representative vector; when performing similarity calculation, the query data set Dq can be used but is not limited to net The probability value of the sample data being correctly predicted is calculated using the calculation formula.

[0171] S503. Based on similarity and similarity Obtain an energy internet intrusion prediction result; wherein the energy internet intrusion prediction result is:

[0172]

[0173] It should be noted that the energy internet intrusion prediction result "nomal" means that the real-time operation data of the energy internet is normal, which means that the energy internet has not been attacked by an intrusion; the energy internet intrusion prediction result "abnomal" means that the real-time operation data of the energy internet is abnormal, which means that the energy internet has been attacked by an intrusion.

[0174] In this embodiment, after obtaining the public dataset, the energy internet dataset, the normal sample dataset, and the small sample attack dataset, the feature vectors in each dataset are preprocessed. The data preprocessing includes the following steps:

[0175] Use one-hot encoding to process the feature vector to obtain encoded data. Specifically, one-hot encoding is used to preprocess discrete features, that is, to convert discrete features into binary one-hot vectors. For example, a computer has three states: on, off, and standby. After encoding, they become [1,0,0], [0,1,0], and [0,0,1].

[0176] The encoded data is normalized to obtain preprocessed data. Specifically, to ensure the normal convergence of the model and reduce computing resource consumption, the continuous features are normalized to unify the dimensions of different features. The processed data takes values ​​between [0, 1].

[0177] In this embodiment, when the initial machine learning model is pre-trained, it is executed locally on the client. During this process, since the data used does not leave the local machine, there is no data leakage problem;

[0178] When the pre-trained feature embedding model is federated, it is executed on each industrial agent, and the parameters of the pre-trained feature embedding model are aggregated through the cloud server; wherein, when the parameters of the pre-trained feature embedding model are aggregated through the cloud server, the FedAvg method is used to aggregate the parameters of the model.

[0179] Specifically, after all A industrial agents participating in the current communication round of training upload their optimal parameters, the model parameters are aggregated on the cloud server using the following formula:

[0180]

[0181] Where: A is the number of industrial agents participating in training in each round of communication, A is the set of industrial agents participating in training in the current communication round, A={A i |i=1,2,...,A}; Indicates industrial agent A iUploaded local model parameters; after C communication rounds are completed, a global model will be generated, which can be used to quickly establish the final intrusion detection model under small sample conditions.

[0182] It's important to note that the industrial agent represents the local client, and federated training is performed on the local client. Data does not leave the local server, and only model parameters are exchanged. During this process, since federated training of the pre-trained feature embedding model is performed on each industrial agent, training data is always stored locally. Each industrial agent only transmits model parameters to the cloud server, thus ensuring data security across industrial networks.

[0183] This embodiment discloses a collaborative intrusion detection method based on federated learning. Specifically, first, public Internet data is used to pre-train on a cloud server to generate a pre-trained feature embedding model; then, drawing on the ideas of federated learning and transfer learning, each industrial agent uses its own industrial data to federate the pre-trained model; on this basis, the IDS deployed in each network can use a very small number of small sample attack samples to build a corresponding detection model, and then generate a final intrusion detection model, so that the final intrusion detection model can effectively perform intrusion detection against small sample attacks.

[0184] The federated learning framework designed in this embodiment ensures data security for the Energy Internet during model construction. This framework enables collaborative training of a global model, with data from each Energy Internet remaining locally during training, effectively preventing privacy leaks and other issues. Furthermore, the final intrusion detection model is generated using a normal sample dataset and the small sample attack dataset, requiring only a small number of common Energy Internet attack samples to provide prior knowledge.

[0185] Example 2:

[0186] See also Figure 4 , an energy internet network threat detection system, used to implement the energy internet network threat detection method in embodiment 1, includes the following modules:

[0187] A pre-training module is used to build an initial machine learning model and obtain a public dataset, and then use the public dataset to pre-train the initial machine learning model to obtain a pre-trained feature embedding model;

[0188] a federated training module, communicatively connected to the pre-training module, configured to obtain an energy internet dataset local to the energy internet, and perform federated training on the pre-trained feature embedding model using the energy internet dataset to obtain a federated trained feature embedding model;

[0189] a final model generation module, which is in communication with the federated training module and is used to obtain a normal sample data set and a small sample attack data set of a specified network intrusion type, input the normal sample data set and the small sample attack data set into the federated training feature embedding model, and generate a final intrusion detection model based on the output results of the federated training feature embedding model;

[0190] The result prediction module is in communication with the final model generation module, and is used to obtain the real-time operation data of the energy internet and preprocess the energy internet operation data to obtain preprocessed data; it is also used to input the preprocessed data into the final intrusion detection model to obtain the energy internet intrusion prediction result.

[0191] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0192] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0193] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0194] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk, and other media that can store program code.

[0195] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structures or equivalent process changes made using the contents of the present invention's description and drawings, or directly or indirectly applied to other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting network threats in energy internet, characterized in that: The following steps are involved: Constructing an initial machine learning model and obtaining a public dataset, and then pre-training the initial machine learning model using a random subset of the public dataset to obtain a pre-trained feature embedding model; Obtaining an energy internet dataset local to the energy internet, and using the energy internet dataset to perform federated training on the pre-trained feature embedding model to obtain a federated trained feature embedding model; Pre-training the initial machine learning model on the local client, and uploading the trained model parameters to the cloud server for storage; Federated training of the pre-trained feature embedding model is performed on each industrial agent, and the parameters of the pre-trained feature embedding model are aggregated by the cloud server using the FedAvg method; Obtaining a normal sample dataset and a small sample attack dataset of a specified network intrusion type, inputting the normal sample dataset and the small sample attack dataset into the federated training feature embedding model, and generating a final intrusion detection model based on an output result of the federated training feature embedding model; Acquiring real-time operation data of the energy internet and preprocessing the energy internet operation data to obtain preprocessed data; The preprocessed data is input into the final intrusion detection model to obtain the energy Internet intrusion prediction result.

2. The energy internet network threat detection method according to claim 1, characterized in that: The initial machine learning model adopts the FE-Net model.

3. The energy internet network threat detection method according to claim 1, characterized in that: The specific steps of constructing the pre-trained feature embedding model are: First, set the public dataset as in, represents the i-th public data sample, is the characteristic vector of the i-th public data sample (x i1 ,x i2 ,…,x it ), is the label of the i-th sample, i is the serial number of the public data sample, N net is the total number of public data samples; The public dataset carries a label type set, which is: L net ={0,1,...,l net }, tag type 0,1,...,l net In the example, 0 represents the positive label, 1,...,l net Representing different types of negative labels; Acquire a pre-training task according to the label type of the negative label in the public dataset, and construct a pre-training dataset for the pre-training task using the public dataset; Pre-training the initial machine learning model using the pre-training dataset of the pre-training task to obtain a loss function corresponding to the pre-training task; The loss function corresponding to the pre-training task is used to update the model parameters in the initial machine learning model to obtain a pre-trained feature embedding model.

4. The energy internet network threat detection method according to claim 3 is characterized in that: The specific steps of using the public dataset to construct the pre-training dataset for the pre-training task are: When the labels included in the pre-training task have negative labels, the data set consisting of all public data samples with label type 0 in the public data set is set as the first data set The data set consisting of all public data samples with negative label type is set as the second data set From the first data set and the second data set In the example, k public data samples are selected to obtain the support data set Ds. net ; Wherein, the supporting data set Ds net ={(x1,y1),...,(x 2k ,y 2k )}; From the first data set The remaining public data samples except the selected k public data samples and the second data set From the remaining public data samples except the selected k public data samples, k' public data samples are selected to obtain the query data set Dq net ; Wherein, the query data set Dq net ={(x 1′ ,y 1′ ),...,(x 2k′ ,y 2k′ )}; The support dataset Ds net and the query dataset Dq net The pre-training dataset T that constitutes the pre-training task net ; Wherein, the pre-training data set T net ={Ds net ,Dq net }.

5. The energy internet network threat detection method according to claim 4, characterized in that: Use the pre-training dataset T of the pre-training task net Pre-train the initial machine learning model to obtain the loss function corresponding to the pre-training task. The specific steps are as follows: From the pre-training dataset T net Support dataset Ds net The sample data in (x s ,y s ), extract the first sample data set with all labels 0 Convert all non-0 labels to 1, and then extract the second sample data set with all labels 1 According to the first sample data set Get the first positive class representative vector, according to the second sample data set Get the first negative class representative vector; Among them, the first positive class representative vector is: The first negative class representative vector is: Where, is the preset parameter of the initial machine learning model; s is the eigenvector; is x s The corresponding model represents the vector; According to the pre-training dataset T net The query dataset Dq net The sample data in (x q ,y q ), the first positive class representative vector and the first negative class representative vector, and obtain the query data set Dq net The probability value of the sample data in being correctly predicted: Where: d(a,b) is the Euclidean square distance between data a and data b, x′ q and y′ q are all constants; y q The corresponding representative vector; According to the query data set Dq net The probability value of the sample data in is correctly predicted, and the initial machine learning model is obtained for x q The loss value is: in: Represents x q The predictive distribution generated by the initial machine learning model, p(x q ) represents the true distribution of the sample; According to the pre-training dataset T net The query dataset Dq net All sample data x in q The loss value of , and the loss function corresponding to the pre-training task are obtained: Among them: α is a parameter used to adjust the weight of the loss function.

6. The energy internet network threat detection method according to claim 5, characterized in that: After updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters are: Where: γ is the weight decay rate to prevent overfitting; η is the learning rate; is the gradient of the loss function, 7. The energy internet network threat detection method according to claim 1, characterized in that: The specific steps for constructing the federated training feature embedding model are as follows: Freeze the first N of the pre-trained feature embedding models frz Layer parameters, get the feature embedding model after parameter freezing; According to the label type of the negative label of the energy internet dataset, a collaborative training task is obtained, and the energy internet dataset is used to construct a collaborative training dataset for the collaborative training task. The specific steps are as follows: First, perform feature alignment on the Energy Internet dataset, retaining only the overlapping features among multiple features, and obtain the aligned small sample dataset: in: represents the i-th energy internet data sample; is the characteristic vector of the i-th energy internet data sample (x i1 ,x i2 ,…,x it ), is the label of the i-th energy internet data sample, i is the sequence number of the energy internet data sample, N ind is the total number of energy internet data samples; The energy internet dataset carries a tag type set, which is: L ind ={0,1,...,l ind }, tag type 0,1,...,l ind In the example, 0 represents the positive label, 1,...,l ind Representing different types of negative labels; When the collaborative training task includes a negative label, the data set consisting of all energy internet data samples with label type 0 in the energy internet data set is set as the third data set The data set consisting of all energy internet data samples with negative label type is set as the fourth data set From the third data set and the fourth data set In the example, k energy internet data samples are selected to obtain the support dataset Ds ind ; Wherein, the supporting data set Ds ind ={(x1,y1),...,(x 2k ,y 2k )}; From the third data set The remaining small sample data samples except the selected k small sample data samples and the fourth data set From the remaining energy internet data samples except the selected k energy internet data samples, k' energy internet data samples are selected to obtain the query data set Dq ind ; Wherein, the query data set Dq ind ={(x 1′ ,y 1′ ),...,(x 2k′ ,y 2k′ )}; The support dataset Ds ind and the query dataset Dq ind The collaborative training dataset T that constitutes the collaborative training task ind ; Wherein, the collaborative training data set T ind ={Ds ind ,Dq ind }; The collaborative training dataset of the collaborative training task is used to collaboratively train the parameter-frozen feature embedding model to obtain a loss function corresponding to the collaborative training task. The specific steps are as follows: From the collaborative training dataset T ind Support dataset Ds ind Small sample data sample (x s ,y s ), extract the third sample data set with all labels as 0 Convert all non-0 labels to 1, and then extract the fourth sample data set with all labels 1 According to the third sample data set Get the collaborative training positive class representative vector, according to the fourth sample data set Get the representative vector of the negative class for collaborative training; The collaborative training positive class representative vector is: The collaborative training negative class representative vector is: Where, is the preset parameter of the initial machine learning model; s is the eigenvector; is x s The corresponding model represents the vector; According to the collaborative training dataset T ind The query dataset Dq ind The sample data in (x q ,y q ), the collaborative training positive class representative vector and the collaborative training negative class representative vector, and obtain the query data set Dq ind The probability value of the sample data in being correctly predicted; Where: d(a,b) is the Euclidean square distance between data a and data b, x′ q and y′ q are all constants; y q The corresponding representative vector; According to the query data set Dq ind The probability value of the sample data in is correctly predicted, and the initial machine learning model is obtained for x q The loss value is: in: Represents x q The predictive distribution generated by the initial machine learning model, p(x q ) represents the true distribution of the sample; According to the collaborative training dataset T ind The query dataset Dq ind All sample data x in q The loss value of , and the loss function corresponding to the collaborative training task are obtained: Among them: α is the parameter used to adjust the weight of the loss function; The loss function corresponding to the collaborative training task is used to update the model parameters in the feature embedding model after the parameters are frozen to obtain a federated training feature embedding model.

8. The energy internet network threat detection method according to claim 1, characterized in that: The specific steps of constructing the final intrusion detection model are: Inputting the normal sample dataset and the small sample attack dataset into the federated training feature embedding model to obtain a third positive class representative vector and a third negative class representative vector; A final intrusion detection model is generated according to the third positive class representative vector, the third negative class representative vector and the federated training feature embedding model.

9. The energy internet network threat detection method according to claim 7, characterized in that: The specific steps for obtaining the energy internet intrusion prediction results are as follows: Inputting the preprocessed data into the final intrusion detection model to obtain a feature embedding vector x′; Get the similarity between the feature embedding vector x′ and the preset positive class representative vector And the similarity between the feature embedding vector x′ and the preset negative class representative vector in, represents aggregated parameters obtained by aggregating the parameters of the pre-trained feature embedding model through the cloud server when the pre-trained feature embedding model is federated and executed on each industrial agent; Based on similarity and similarity Obtain an energy internet intrusion prediction result; wherein the energy internet intrusion prediction result is:

Images