A power grid intrusion detection method and system

Abstract

The application relates to a power grid intrusion detection method and system, which comprises the following steps: firstly, an initial machine learning model is constructed, and the initial machine learning model is trained based on a public data set to obtain an initial feature embedding model; in the process of training the initial machine learning model, knowledge from a common industrial data set is aggregated; secondly, the initial feature embedding model is further trained based on a small sample data set of a local power grid to obtain a cooperatively trained feature embedding model, so that the finally obtained model aggregates knowledge from the small sample data set. In the training process of the model, a small amount of samples can be used, and the cooperatively trained feature embedding model proposed by the application can effectively detect network attacks on the power grid and has the ability to detect unknown network attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to a power grid intrusion detection method and system, belonging to the technical field of network attack detection. BACKGROUND

[0002] With the increasing digitization and intelligentization of power grids, network attacks pose a great threat to the safe operation of the power industry. For example, in 2020, the American power company was attacked by a hacker organization. In the same year, the Venezuelan national power grid was attacked again, causing a nationwide power outage. Before taking countermeasures, it is crucial to effectively detect such network attacks.

[0003] However, traditional intrusion detection systems can only effectively detect known attacks when enough attack samples are available, and their detection efficiency is very low for network attacks with only a few attacks or even unknown network attacks. Based on this, existing technologies use deep learning techniques to detect unknown attacks.

[0004] For example, in 2019, S. Ahmed et al. proposed a scheme based on unsupervised machine learning (S. Ahmed, Y. Lee, S.-H. Hyun and I. Koo, "Unsupervised Machine Learning-Based Detection of Covert Data Integrity Assault in power grids Networks Utilizing Isolation Forest," in IEEE Transactions on Information Forensics and Security, vol. 14, no. 10, pp. 2765-2777, 2019.) using unlabeled data to detect covert data integrity attacks in power grid communication networks. In 2021, in order to improve the security performance of power grids, F. Li et al. adopted a nonlinear iterative algorithm based on a deep belief network (F. Li, Y. Wu, Y. Liu, Y. Tian and H. Yang, "power grids System Security Protection by Deep Neural Network," 2021 International Conference on Machine Learning and Intelligent Systems Engineering (MLISE), pp. 290-295, 2021.) to automatically select features, improving the model accuracy of covert behavior in known complex attacks and highly covert attacks. In 2022, M. Massaoudi et al. proposed an enhanced extreme random tree classifier based on synthetic minority over-sampling technique to analyze network traffic (M. Massaoudi, S. S. Refaat and H. Abu-Rub, "Intrusion Detection Method Based on SMOTE Transformation for power grids Cybersecurity," 2022 3rd International Conference on power grids and Renewable Energy (SGRE), pp. 1-6, 2022.), which can accurately classify unbalanced data and identify unknown network attacks and malware.

[0005] However, in the use of the prior art, the inventors found that at least the following problems exist in the prior art:

[0006] The deep learning technology is too dependent on the amount of data, and in a real scene, the power grid is difficult to capture enough common attack samples, which cannot provide enough prior knowledge for model training, so that the prediction model cannot be effectively established under the condition of small samples, which is not conducive to the effective detection of power grid network attacks. SUMMARY

[0007] In order to solve the problems existing in the prior art, the present application provides.

[0008] The technical scheme of the present application is as follows:

[0009] On the one hand, the present application provides a power grid intrusion detection method, comprising the following steps:

[0010] An initial machine learning model is constructed, and the initial machine learning model is pre-trained using a public data set to obtain an initial feature embedding model;

[0011] A small sample data set of the power grid is obtained, and the initial feature embedding model is co-trained using the small sample data set to obtain a co-trained feature embedding model;

[0012] Real-time operation data of the power grid are obtained, and the power grid operation data are preprocessed to obtain preprocessed data;

[0013] The preprocessed data are input into the co-trained feature embedding model to obtain a power grid intrusion prediction result.

[0014] As a preferred embodiment of the present application, the initial feature embedding model construction step is:

[0015] First, the public data set is set as

[0016] Wherein, represents the i-th public data sample, is the feature vector (x i1 , x i2 ,..., x it ) of the i-th public data sample, is the label of the i-th sample, and i is the number of public data samples;

[0017] The public data set carries a label type set, and the label type set is: L net ={0, 1,..., l net}, wherein the label types 0, 1,..., l net , 0 represents a positive label, and 1,..., l net represent different types of negative labels;

[0018] According to a label type in the public dataset, a pre-training task is obtained, and a pre-training dataset of the pre-training task is constructed using the public dataset;

[0019] The initial machine learning model is pre-trained using the pre-training dataset of the pre-training task, to obtain a loss function corresponding to the pre-training task;

[0020] The model parameters in the initial machine learning model are updated using the loss function corresponding to the pre-training task, to obtain an initial feature embedding model.

[0021] As a preferred embodiment of the present application, the specific steps of constructing the pre-training dataset of the pre-training task using the public dataset are as follows:

[0022] When the pre-training task includes negative labels, a data set composed of all public data samples with a label type of 0 in the public dataset is set as a first data set A data set composed of all public data samples with a label type of negative labels is set as a second data set

[0023] From the first data set and the second data set , respectively, k public data samples are selected to obtain a support dataset Ds net ; wherein the support dataset Ds net ={(x1, y1),..., (x 2k , y 2k )};

[0024] From the remaining public data samples in the first data set except the selected k public data samples and the remaining public data samples in the second data set except the selected k public data samples, respectively, k' public data samples are selected to obtain a query dataset Dq net ; wherein the query dataset Dq net ={(x 1′ , y 1′ ),..., (x 2k′ , y 2k′ )};

[0025] The support dataset Ds net and the query dataset Dq net are combined to form a pre-training dataset T net of the pre-training task; wherein the pre-training dataset T net ={Ds net , Dqnet}。

[0026] As a preferred embodiment of the present application, the pre-training data set T net The initial machine learning model is pre-trained to obtain a loss function corresponding to the pre-training task, and the specific steps are as follows:

[0027] From the pre-training data set T net Support data set Ds net Common data samples (x s , y s ) are extracted to obtain a first sample data set All non-0 labels are converted to 1, and then a second sample data set

[0028] According to the first sample data set The pre-training positive class representative vector is obtained, and the second sample data set The pre-training negative class representative vector is obtained.

[0029] Wherein, the pre-training positive class representative vector is:

[0030]

[0031] The pre-training negative class representative vector is:

[0032]

[0033] In the formula, The preset parameter of the initial machine learning model; x s The feature vector; The model representative vector corresponding to x s ;

[0034] According to the sample data (x net , y net ) in the query data set Dq q of the pre-training data set T q The pre-training positive class representative vector and the pre-training negative class representative vector are used to obtain the probability value of the sample data in the query data set Dq net Being correctly predicted:

[0035]

[0036] Wherein: d(a, b) is the Euclidean square distance between data a and data b, The representative vector corresponding to y q ; a representative vector corresponding to a constant c, c∈{0, 1}, obtained by the pre-trained positive class representative vector and the pre-trained negative class representative vector; x q a model representative vector corresponding to the initial machine learning model;

[0037] According to the query data set Dq net The probability value of the sample data being correctly predicted is obtained. The loss value of the initial machine learning model to x q ; wherein the loss value of the initial machine learning model to x q is:

[0038]

[0039] According to the loss value of all sample data x net in the query data set Dq net of the pre-training data set T q , the loss function corresponding to the pre-training task is obtained; wherein the loss function is:

[0040]

[0041] wherein y q represents the true label; represents the probability of predicting the label y q under the condition of given input x and model parameter .

[0042] As a preferred embodiment of the present application, after updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters are:

[0043]

[0044] wherein γ is the weight decay rate to prevent overfitting; η is the learning rate; is the gradient of the loss function,

[0045] As a preferred embodiment of the present application, the specific construction steps of the co-training feature embedding model are:

[0046] Freezing the first N frz layer parameters of the initial feature embedding model to obtain a parameter-frozen feature embedding model;

[0047] According to the label type of the negative label of the small sample data set, a co-training task is obtained, and a co-training data set of the co-training task is constructed using the small sample data set;

[0048] The parameter frozen feature embedding model is co-trained using the co-training data set of the co-training task, to obtain a loss function corresponding to the co-training task;

[0049] The model parameters in the parameter frozen feature embedding model are updated using the loss function corresponding to the co-training task, to obtain a co-training feature embedding model.

[0050] As a preferred embodiment of the present application, the co-training data set of the co-training task is specifically constructed in the following steps:

[0051] First, the small sample data set is aligned in features, only the overlapping features in the multiple features are retained, to obtain a small sample data set after alignment:

[0052]

[0053] Wherein: represents the i-th small sample data sample; is the feature vector of the i-th small sample data sample (x i1 , x i2 ,..., x it ), is the label of the i-th small sample data sample, and i is the number of small sample data samples;

[0054] The small sample data set carries a label type set, and the label type set is: L ind ={0, 1,..., l ind}, wherein 0 represents a positive label, 1,..., l ind represent different types of negative labels; ind

[0055] When the co-training task includes a negative label, a data set composed of all small sample data samples with a label type of 0 in the small sample data set is set as a third data set A data set composed of all small sample data samples with a label type of a negative label is set as a fourth data set

[0056] From the third data set and the fourth data set , respectively, k small sample data samples are selected to obtain a support data set Ds ind ; wherein the support data set Ds​ind = {(x1, y1),..., (x 2k , y 2k )};

[0057] From the remaining small sample data samples in the third data set selected k small sample data samples and the fourth data set selected k small sample data samples, obtain the query data set Dq ind ; wherein the query data set Dq ind = {(x 1′ , y 1′ ),..., (x 2k′ , y 2k′ )};

[0058] The support data set Ds ind and the query data set Dq ind are combined to form the co-training data set T of the co-training task ind ; wherein the co-training data set T ind = {Ds ind , Dq ind}.

[0059] As a preferred embodiment of the present application, the co-training data set of the co-training task is used to co-train the parameter frozen feature embedding model, and the loss function corresponding to the co-training task is obtained, and the specific steps are as follows:

[0060] From the small sample data samples (x s , y s ) in the support data set Ds ind of the co-training data set T ind , a third sample data set with all labels as 0 is extracted Convert all non-0 labels to 1, and then extract a fourth sample data set with all labels as 1

[0061] According to the third sample data set , a co-training positive class representative vector is obtained, and according to the fourth sample data set , a co-training negative class representative vector is obtained

[0062] ; wherein the co-training positive class representative vector is:

[0063]

[0064] The co-training negative class representative vector is:

[0065]

[0066] wherein, is a preset parameter of the initial machine learning model; x s is a feature vector; is x s a corresponding model representative vector;

[0067] According to the query data set Dq ind of the collaborative training data set T ind , the sample data (x q , y q ) in the query data set Dq ind , the collaborative training positive class representative vector and the collaborative training negative class representative vector, the probability value that the sample data in the query data set Dq q is correctly predicted is obtained:

[0068]

[0069] wherein: d (a, b) is the Euclidean square distance between data a and data b, is the corresponding representative vector of y q ; is the corresponding representative vector of a constant c, c∈{0, 1}, obtained through the collaborative training positive class representative vector and the collaborative training negative class representative vector; is the corresponding model representative vector of x q ;

[0070] According to the probability value that the sample data in the query data set Dq ind is correctly predicted, the loss value of the initial machine learning model to x q is obtained; wherein the loss value of the parameter frozen feature embedding model to x q is:

[0071]

[0072] According to the loss value of all sample data x ind in the query data set Dq ind of the collaborative training data set T q , the loss function corresponding to the collaborative training task is obtained; wherein the loss function is:

[0073]

[0074] wherein: y q represents the true label; represents the loss value of the model parameter In the case that the prediction label is y q , the probability is calculated.

[0075] As a preferred embodiment of the present application, the specific steps for obtaining the power grid intrusion prediction result are as follows:

[0076] The preprocessed data is input into the post-collaborative training feature embedding model to obtain a feature embedding vector x'.

[0077] The similarity between the feature embedding vector x' and a preset positive class representative vector is obtained and the similarity between the feature embedding vector x' and a preset negative class representative vector is obtained

[0078] The power grid intrusion prediction result is obtained according to the similarity and the similarity ; wherein the power grid intrusion prediction result is:

[0079]

[0080] In another aspect, the present application also provides a power grid intrusion detection system, comprising the following modules:

[0081] A pre-training module is configured to construct an initial machine learning model and pre-train the initial machine learning model using a public data set to obtain an initial feature embedding model.

[0082] A collaborative training module is in communication connection with the pre-training module and is configured to obtain a pre-training model and perform collaborative training on the initial feature embedding model using a small sample data set constructed by collecting data in a power grid to obtain a post-collaborative training feature embedding model.

[0083] A result prediction module is in communication connection with the collaborative training module and is configured to obtain a post-collaborative training feature embedding model and preprocess power grid operation data collected in real time in the power grid to obtain preprocessed data; and input the preprocessed data into the post-collaborative training feature embedding model to obtain a power grid intrusion prediction result.

[0084] The present application has the following beneficial effects:

[0085] 1. This invention further trains the initial feature embedding model on a small sample dataset based on the local power grid to obtain a co-trained feature embedding model. This results in a model that aggregates knowledge from the small sample dataset, making it suitable for power grid scenarios with only a small sample size. During the model training process, this invention requires a small number of samples. At the same time, the co-trained feature embedding model proposed in this invention can effectively detect network attacks targeting the power grid and has the ability to detect unknown network attacks. It can simultaneously detect both small sample attacks and unknown network attacks. Attached Figure Description

[0086] Figure 1 This is a flowchart of the method of the present invention;

[0087] Figure 2 The figure shows the comparison results of the detection performance of the collaboratively trained feature embedding model TL-IDS of this invention on the ICS-NGP and ICS-WST datasets;

[0088] Figure 3 This figure shows a comparison of the accuracy of the collaboratively trained feature embedding model TL-IDS of this invention and existing techniques during training on the ICS-WST dataset.

[0089] Figure 4 This figure shows a comparison of the accuracy of the collaboratively trained feature embedding model TL-IDS of this invention and existing techniques during training on the ICS-NGP dataset.

[0090] Figure 5 This is a system module block diagram of the present invention. Detailed Implementation

[0091] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0092] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0093] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0094] The terms “comprise” and “contain” indicate the presence of the described features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0095] The term “and / or” means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0096] Embodiment I:

[0097] Referring to Figure 1 A power grid intrusion detection method, comprising the following steps:

[0098] S1. An initial machine learning model is constructed, and the initial machine learning model is pre-trained using a public data set to obtain an initial feature embedding model; it should be understood that in this embodiment, the initial machine learning model is pre-trained using a pre-processed public data set. It should be noted that the public data set is a public Internet data set of an industrial power grid network that has been published. Since there are few common attack samples in the industrial Internet data, it may not be sufficient to provide prior knowledge for model training. In this stage, the initial training stage of the model is completed by pre-training the initial machine learning model using the public data set.

[0099] Specifically, the public data set is set as Any public data , is the feature vector (x i1 ,x i2 ,…,x it ) of the i-th sample, is the label of the i-th sample; the public data set carries a label type set, and the label type set is: L net ={0,1,..., net}, the label types 0, 1,..., net , 0 represents a positive label, and 1,..., net represent different types of negative labels; as an example, in the label type set, 1 is a simple malicious response injection attack, 2 is a complex malicious response injection attack, 3 is a malicious state command injection attack, etc., which are not limited here.

[0100] An initial machine learning model is constructed, and the initial machine learning model is pre-trained using a public data set to obtain an initial feature embedding model, comprising:

[0101] S101. According to the label type in the public data set, a pre-training task is obtained, and a pre-training data set T of the pre-training task is constructed using the public data setnet ;

[0102] When the pre-training task includes a negative label atk, all public data with a label type of 0 in the public data set is set as a first data set All public data with a label type of atk is set as a second data set Specifically, in the embodiment, the pre-training task is obtained according to the label type of the negative label atk in the public data set; and a pre-training data set T of the pre-training task is constructed using the public data set net , comprising:

[0103] S101a. From the first data set and the second data set , respectively select k sample data to obtain a support data set Ds net ; wherein the support data set Ds net ={(x1, y1),..., (x 2k , y 2k )};

[0104] S101b. From the first data set , respectively select k sample data from the remaining public data other than the k sample data and the second data set , respectively select k sample data from the remaining public data other than the k sample data to obtain a query data set Dq net ; wherein the query data set Dq net ={(x1, y1),..., (x 2k′ , y 2k′ )};

[0105] In order to facilitate subsequent pre-training of the initial machine learning model and calculation of the loss function, in the embodiment, after obtaining the support data set Ds net and the query data set Dq net , the public data in the support data set Ds net and the query data set Dq net is reshaped into a two-dimensional form, and the support data set and the query data set at this time are represented as follows:

[0106] Ds net ={(x 11 , x 12 , …, x 1t , y′1), …, (x i1 , x i2 , …, x it , y′ i ), …, (x2k1 , x 2k2 ,..., x 2kt , y' 2k )};

[0107] Dq net = {(x 11 , x 12 ,..., x 1t , y'1),..., (x i1 , x i2 ,..., x it , y' i ),..., (x 2k′1 , x 2k′2 ,..., x 2k′t , y' 2k′ )};

[0108] According to the label type set carried by the support data set Ds net and the label type set carried by the query data set Dq net , all labels in the support data set Ds net and the query data set Dq net that are negative labels are reset to 1; wherein the reset label corresponding to the ith common data in the support data set Ds net and the query data set Dq net is:

[0109]

[0110] S101c. The support data set Ds net and the query data set Dq net are combined to form a pre-training data set T net of the pre-training task; wherein the pre-training data set T net = {Ds net , Dq net}.

[0111] It should be understood that at this time, the pre-training data set T net of the pre-training task carried by the task label type set is wherein atk is any negative label in 1,..., l net .

[0112] S102. The initial machine learning model is pre-trained using the pre-training data set T net of the pre-training task to obtain a loss function corresponding to the pre-training task;

[0113] In this embodiment, the pre-training data set Tnet The initial machine learning model is pre-trained to obtain a loss function corresponding to the pre-training task, comprising:

[0114] S102a. From the sample data (x net , y net ) in the support data set Ds s of the pre-training data set T s , a first sample data set with all labels as 0 and a second sample data set with all labels as 1 are extracted.

[0115] S102b. A pre-training positive class representative vector is obtained according to the first sample data set , and a pre-training negative class representative vector is obtained according to the second sample data set , so as to realize the mapping between the input and output of the initial machine learning model; wherein the pre-training positive class representative vector is: The pre-training negative class representative vector is: In the formula, is a preset parameter of the initial machine learning model, is the model representative vector corresponding to x s ;

[0116] At this time, the pre-training positive class representative vector, the pre-training negative class representative vector and the initial machine learning model jointly constitute a prediction model of the pre-training task;

[0117] S102c. According to the sample data (x net , y net ) in the query data set Dq q of the pre-training data set T q , the pre-training positive class representative vector and the pre-training negative class representative vector, the probability value of the sample data in the query data set Dq net being correctly predicted is obtained; wherein the probability value of the sample data in the query data set Dq net being correctly predicted is:

[0118]

[0119] In the formula, d(a, b) is the Euclidean square distance between data a and data b, is the representative vector corresponding to y q ; is the representative vector corresponding to a constant c, c∈{0,1}, obtained through the pre-training positive class representative vector and the pre-training negative class representative vector; is x q a corresponding model representative vector;

[0120] S102d. According to the query data set Dq net The probability value of the sample data being correctly predicted is obtained. The loss value of the initial machine learning model for x q ; wherein the loss value of the initial machine learning model for x q is:

[0121]

[0122] S102e. According to the loss value of all sample data x net in the query data set Dq net of the pre-training data set T q , obtain the loss function corresponding to the pre-training task; wherein the loss function is:

[0123]

[0124] S103. Update the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task to obtain an initial feature embedding model.

[0125] Specifically, in this embodiment, after updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters are:

[0126]

[0127] wherein γ is the weight decay rate to prevent overfitting; η is the learning rate; is the gradient of the loss function,

[0128] In this embodiment, multiple pre-training tasks are constructed, and the initial machine learning model is pre-trained using multiple pre-training task pairs T net , and when the value of the loss function reaches a threshold, a converged initial feature embedding model is obtained.

[0129] S2. Obtain a small sample data set in the local power grid, and use the small sample data set to cooperatively train the initial feature embedding model to obtain a cooperatively trained feature embedding model; it should be noted that although the public data in the public data set provides certain prior knowledge, due to some differences in data distribution, the initial feature embedding model obtained after pre-training cannot achieve the best effect in the special industrial intrusion detection task. Therefore, the initial feature embedding model is further cooperatively trained by using the small sample data set of a specified number of local power grid pre-stored in the power grid control center, so as to further obtain the cooperatively trained feature embedding model. Specifically, in the embodiment, the step of cooperatively training the initial feature embedding model is performed in the power grid control center.

[0130] In the embodiment, a small sample data set in the local power grid is obtained, and the small sample data set is used to cooperatively train the initial feature embedding model to obtain a cooperatively trained feature embedding model, comprising:

[0131] S201. Freeze the first N frz layer parameters of the initial feature embedding model to obtain a parameter-frozen feature embedding model, so that the first N grz layer parameters do not participate in gradient descent, thereby ensuring the stability of the model;

[0132] S202. Perform feature alignment processing on all data in the small sample data set to obtain a preprocessed small sample data set, so as to obtain a cooperative training task according to the label type of the negative label of the preprocessed small sample data set; it should be noted that performing feature alignment processing on all data in the small sample data set means that only the coincident features in the multiple features are retained.

[0133] S203. Obtain a cooperative training task according to the label type of the negative label of the small sample data set, and use the small sample data set to construct a cooperative training data set T ind of the cooperative training task; specifically, in the embodiment, according to the small sample data set and the label type set L ind ={0,..., l ind}, the cooperative training data set T ind ={Ds ind , Dq ind} of the pre-training task can be constructed; wherein Ds ind and Dq ind represent the support data set and the query data set established on the industrial data in the small sample data set, respectively;

[0134] S204. using the co-training data set T of the co-training task ind co-training the parameter frozen feature embedding model to obtain a loss function corresponding to the co-training task;

[0135] S205. updating the model parameters in the parameter frozen feature embedding model using the loss function corresponding to the co-training task to obtain a co-training feature embedding model. It should be understood that when the model parameters in the parameter frozen feature embedding model are updated, the model parameters in the parameter frozen feature embedding model are the latest model parameters in the initial feature embedding model.

[0136] Specifically, in the embodiment, according to the support data set Ds ind and the query data set Dq ind the co-training positive class representative vector and the co-training negative class representative vector For each sample data (x ind , y q ) in the query data set Dq q , (x q , y q ) ∈ Dq ind , the embedding loss of the parameter frozen feature embedding model for the sample data is calculated using and and the loss function corresponding to the co-training task can be further obtained. Finally, according to the loss function corresponding to the co-training task, the model parameters in the parameter frozen feature embedding model are updated, and a co-training feature embedding model is obtained. The above calculation process is consistent with the calculation process in the pre-training step, which will not be described here.

[0137] S3. obtaining real-time operation data of a power grid and pre-processing the power grid operation data to obtain pre-processed data;

[0138] In the embodiment, when the power grid operation data is continuous data, the power grid operation data is pre-processed to obtain pre-processed data, including:

[0139] using a normalization method to convert all features in the power grid operation data to a unified scale to obtain pre-processed data; wherein the hth feature value of the jth column feature in the pre-processed data is:

[0140]

[0141] In the formula, is the hth feature value of the jth column feature in the power grid operation data, is the maximum eigenvalue of the jth column feature in the power grid operation data, is the minimum eigenvalue of the jth column feature in the power grid operation data;

[0142] When the power grid operation data is discrete data, the power grid operation data is preprocessed to obtain preprocessed data, including:

[0143] The power grid operation data is processed using one-hot encoding to obtain preprocessed data. It should be noted that assuming that a column of discrete features of the power grid operation data contains N different values, after one-hot encoding processing, each value of the power grid operation data is encoded into a unique vector composed of N-1 "0"s and one "1".

[0144] S4. The preprocessed data is input into the co-training post-feature embedding model to obtain a power grid intrusion prediction result.

[0145] Specifically, in the embodiment, the preprocessed data is input into the co-training post-feature embedding model to obtain a power grid intrusion prediction result, including:

[0146] S401. The preprocessed data is input into the co-training post-feature embedding model to obtain a feature embedding vector x';

[0147] S402. The similarity between the feature embedding vector x' and a preset positive class representative vector and the similarity between the feature embedding vector x' and a preset negative class representative vector Specifically, in the embodiment, the preset positive class representative vector can be but is not limited to a pre-training positive class representative vector or a co-training positive class representative vector, and the preset negative class representative vector can be but is not limited to a pre-training negative class representative vector or a co-training negative class representative vector; when calculating the similarity, the calculation formula of the probability value of the sample data in the query data set Dq net being correctly predicted can be but is not limited to being used for calculation.

[0148] S403. According to the similarity and the similarity a power grid intrusion prediction result is obtained; wherein the power grid intrusion prediction result is:

[0149]

[0150] It should be noted that the power grid intrusion prediction result nomal means that the real-time operation data of the power grid is normal data, that is, it indicates that the power grid has not been attacked, and the power grid intrusion prediction result abnomal means that the real-time operation data of the power grid is abnormal data, that is, it indicates that the power grid has been attacked.

[0151] To better simulate the real industrial power grid environment, the inventors of the present application use ICS-WST and ICS-NGP datasets as small sample datasets, and use KDD 99 dataset as a public dataset. Before model training, a series of preprocessing operations are performed on the small sample dataset and the public dataset respectively, and the preprocessing process includes:

[0152] a1. Fill in the default value. If there is a default value, replace it with the average value of the dimension feature.

[0153] a2. Standardization processing of continuous data. Use the normalization method to rescale each dimension feature to [0, 1].

[0154] a3. Encoding of discrete data. Adopt one-hot encoding to encode each data on the discrete feature into a unique vector composed of "1" and "0".

[0155] a4. Extend the data. After the above steps, in order to make the sample can be normally converted into two-dimensional data, use "0" to extend the insufficient dimension.

[0156] Based on the above steps a1-a4, the dimensions of each sample in the preprocessed ICS-WST, ICS-NGP and KDD 99 datasets are 625 (25*25), 144 (12*12) and 144 (12*12) respectively.

[0157] In order to fully verify the effectiveness of the proposed TL-IDS in unknown attack detection, the training set selects any four attack label samples (label = {0, 2, 3, 6}) for training, and other label samples (label = {1, 4, 5, 7}) are regarded as unknown attacks for testing. Figure 2 The experimental results of the detection ability of unknown attacks on different datasets are shown.

[0158] Overall, TL-IDS performs well on various evaluation indicators (Acc, Pre, Rec and F1) on two datasets. The model performs better on the ICS-WST dataset, with all data close to 1, meaning the performance is close to the ideal model. The performance on the ICS-NGP dataset is poorer, with a value of about 0.7, but it also means that it has certain detection ability for unknown attacks.

[0159] At the same time, the proposed TL-IDS is compared with the following three existing technologies to show the effectiveness of the proposed TL-IDS:

[0160] 1) B. Li et al. proposed a deep learning-based intrusion detection scheme for industrial CPS in 2021 (B. Li, Y. Wu, J. Song, R. Lu, T. Li, and L. Zhao, "DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber-Physical Systems," in IEEE Transactions on Industrial Informatics, vol. 17, no. 8, pp. 5615-5624, 2021.). The scheme designed a detection model composed of a gated recurrent unit, a CNN module, and an MLP module.

[0161] 2) P. T. Duy et al. proposed an intrusion detection scheme for industrial internet SDN networks in 2021 (P. T. Duy, T. V. Hung, N. H. Ha, H. D. Hoang, and V.-H. Pham, "Federated learning-based intrusion detection in SDN-enabled IIoT networks," 2021 8th NAFOSTED Conference on Information and Computer Science (NICS), pp. 424-429, 2021.), which adopted a CNN-based detection model to detect intrusion attacks.

[0162] 3) Y. Chen et al. proposed a CNN-based threat data classification framework in 2020 (Y. Chen, X. Qin, J. Wang, C. Yu, and W. Gao, "FedHealth: A Federated Transfer Learning Framework for Wearable Healthcare," in IEEE Intelligent Systems, vol. 35, no. 4, pp. 83-93, 2020.), which included two convolutional layers, two pooling layers, two fully connected layers, and a classification layer.

[0163] As shown in Figure 3 , the detection accuracy of the proposed TL-IDS model is higher than 90% on the ICS-WST dataset, while the accuracy of other methods is lower than 80%. As shown in Figure 4As shown, the detection accuracy of the collaborative training post-feature embedding model TL-IDS proposed in this embodiment is higher than 85% on the ICS-NGP dataset, while the accuracy of other methods is lower than 75%. Overall, the performance on the ICS-WST dataset is generally higher than that on the ICS-NGP dataset.

[0164] More importantly, the detection accuracy of the prior art is lower than the collaborative training post-feature embedding model TL-IDS proposed in this embodiment, and the detection effect on different datasets fluctuates greatly, indicating that the model of the prior art has not reached a convergent state. It is speculated that the prior art mainly uses a deep learning model, which is highly sensitive to the number of samples. Therefore, in the case of small samples, the prediction model cannot be effectively established.

[0165] The embodiment can realize the detection of known network attacks and unknown network attacks with small samples. Specifically, in the implementation process of the embodiment, first, an initial machine learning model is constructed, and the initial machine learning model is trained based on a public dataset to obtain an initial feature embedding model. In the process of training the initial machine learning model, knowledge from common industrial datasets is aggregated; second, the initial feature embedding model is further trained based on a small sample dataset of the power grid to obtain a collaborative training post-feature embedding model, so that the finally obtained model aggregates knowledge from the small sample dataset and is suitable for the power grid scenario with only small samples. In the training process of the model, the embodiment needs a small amount of samples, and according to the experimental results, it can be known that the collaborative training post-feature embedding model TL-IDS proposed in this embodiment can effectively detect network attacks against the power grid and has the ability to detect unknown network attacks. The model obtained by the embodiment can simultaneously realize the detection of small sample attacks and unknown network attacks.

[0166] Embodiment two:

[0167] Referring to Figure 5 A power grid intrusion detection system includes the following modules:

[0168] A pre-training module is configured to construct an initial machine learning model and pre-train the initial machine learning model using a public dataset to obtain an initial feature embedding model.

[0169] A collaborative training module is in communication connection with the pre-training module and is configured to obtain the pre-trained model and collaboratively train the initial feature embedding model using a small sample dataset constructed by collecting data in the power grid to obtain a collaborative training post-feature embedding model.

[0170] The result prediction module, in communication connection with the co-training module, is configured to acquire the feature embedding model after co-training, and pre-process the data collected in real time in the power grid, i.e., power grid operation data, to obtain pre-processed data; and is further configured to input the pre-processed data into the feature embedding model after co-training to obtain a power grid intrusion prediction result.

[0171] In the embodiments of the present application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B, which can represent the cases of A alone, A and B together, and B alone. Wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the front and rear associated objects. "At least one of the following" and the like means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, wherein a, b, and c can be single or multiple.

[0172] Those skilled in the art can realize that the units and algorithm steps described in the embodiments disclosed herein can be realized by electronic hardware, computer software and combination of electronic hardware and computer software. Whether the functions are realized in hardware or software mode depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0173] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0174] In several embodiments provided in the present application, any function, if realized in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0175] The above description is only some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, based on the content of the specification and drawings of the present application, are also included in the patent protection scope of the present application.

Claims

1. A method of power grid intrusion detection, the method comprising: The method comprises the following steps: constructing an initial machine learning model and pre-training the initial machine learning model using a public data set to obtain an initial feature embedding model; obtaining a small sample data set of a local power grid and co-training the initial feature embedding model using the small sample data set to obtain a co-trained feature embedding model; The co-trained feature embedding model comprises the following steps: freezing the front layer parameters of the initial feature embedding model, to obtain a parameter-frozen feature embedding model; According to the label type of the negative label of the small sample data set, a co-training task is obtained, and a co-training data set of the co-training task is constructed using the small sample data set, and the specific steps are as follows: First, the small sample data set is aligned, only the overlapping features in the multiple features are retained, and the aligned small sample data set is obtained: wherein: represents the th small sample data sample; is a feature vector of the th small sample data sample , is a label of the th small sample data sample, is a serial number of the small sample data sample, is a total number of the small sample data samples; The small sample data set carries a label type set, and the label type set is: , label type Among them, 0 represents a positive label, represent different types of negative labels; When the co-training task includes negative labels, a data set composed of all small sample data samples with a label type of 0 in the small sample data set is set as a third data set a data set composed of all small sample data samples with a label type of negative labels is set as a fourth data set ; from the third data set and the fourth data set , respectively, select k small sample data samples, obtain a support data set ; wherein the support data set ; from the third data set k k k’ ​​​​​​​ combining the support dataset and the query dataset to form a co-training dataset for the co-training task ; wherein the co-training dataset ; The co-training data set of the co-training task is used to co-train the parameter frozen feature embedding model, and a loss function corresponding to the co-training task is obtained, and the specific steps are as follows: from the co-training dataset support dataset small sample data samples in the support dataset , a third sample dataset of all labels being 0 , and a fourth sample dataset of all labels being 1 ; According to the third sample data set a co-training positive class representative vector is obtained according to the fourth sample data set a co-training negative class representative vector is obtained The co-training positive class representative vector is: The co-training negative class representative vector is: In the formula, a preset parameter of the initial machine learning model; a feature vector; is a corresponding model representative vector; According to the co-training dataset of query dataset of sample data , the co-training positive class representative vector and the co-training negative class representative vector, the probability value that the sample data in the query dataset is correctly predicted: wherein: is data is data is the Euclidean squared distance between data ; is is the corresponding representative vector is a constant c is the corresponding representative vector , is obtained by the co-training positive class representative vector and the co-training negative class representative vector is is the corresponding model representative vector According to the probability value of the sample data in the query data set being correctly predicted , a loss value of the initial machine learning model to is obtained; wherein the loss value of the parameter frozen feature embedding model to is: According to the co-training data set The query data set The loss value of all sample data in the query data set, the loss function corresponding to the co-training task is obtained; wherein the loss function is: where: represents the true label; represents the predicted label; and model parameters the probability that the predicted label is​ The loss function corresponding to the co-training task is used to update the model parameters in the parameter frozen feature embedding model to obtain a co-trained feature embedding model. Obtain real-time operation data of the power grid, and pre-process the power grid operation data to obtain pre-processed data. The pre-processed data is input into the co-trained feature embedding model to obtain a power grid intrusion prediction result.

2. The method of grid intrusion detection of claim 1, wherein, The initial feature embedding model comprises the following steps: First, the public dataset is set as ; wherein, represents the th common data sample, is a feature vector of the th common data sample , is a label of the th sample, is a serial number of the common data sample, is a total number of the common data samples; The public dataset carries a set of label types, which are: , label types Among them, 0 represents a positive label, represent different types of negative labels; According to the label type in the public data set, a pre-training task is obtained, and a pre-training data set of the pre-training task is constructed using the public data set; The pre-training data set of the pre-training task is used to pre-train the initial machine learning model to obtain a loss function corresponding to the pre-training task; The loss function corresponding to the pre-training task is used to update the model parameters in the initial machine learning model to obtain an initial feature embedding model.

3. A power grid intrusion detection method according to claim 2, characterized in that, The specific steps for constructing the pre-training data set of the pre-training task using the public data set are as follows: when the pre-training task includes a negative label, set a data set composed of all public data samples with a label type of 0 in the public data set as a first data set set a data set composed of all public data samples with a label type of a negative label as a second data set ; from the first data set and the second data set , respectively, select k common data samples, to obtain a support data set ; wherein the support data set ; from the first data set k remaining common data samples in the first data set k k’ ;​​​​​ combining the support dataset and the query dataset to form a pre-training dataset for the pre-training task ; wherein the pre-training dataset .

4. A power grid intrusion detection method according to claim 3, characterized in that, a pre-training data set of the pre-training task pre-training the initial machine learning model to obtain a loss function corresponding to the pre-training task, specifically comprising the following steps: From the pre-trained dataset Supported datasets Public data samples Extracting all first sample datasets with a label of 0 yields the desired result. and the second sample dataset with all labels of 1 ; According to the first sample data set a pre-trained positive class representative vector is obtained according to the second sample data set a pre-trained negative class representative vector is obtained The pre-training positive class representative vector is: ； The pre-training negative class representative vector is: ； In the formula, a preset parameter of the initial machine learning model; a feature vector; is a corresponding model representative vector; According to the pre-training data set of query data set of sample data , the pre-training positive class representative vector and the pre-training negative class representative vector, the probability value that the sample data in the query data set is correctly predicted: wherein: is data is data is the Euclidean squared distance between data ; is is the corresponding representative vector; is a constant c is the corresponding representative vector, , obtained by the pre-trained positive class representative vectors and the pre-trained negative class representative vectors; is is the corresponding model representative vector; According to the query dataset , a probability value of the sample data being correctly predicted, obtaining a loss value of the initial machine learning model ; wherein the loss value of the initial machine learning model is: According to the pre-training data set The loss value of all sample data in the query data set The loss function corresponding to the pre-training task is obtained; wherein the loss function is:​ where: represents the true label; represents the predicted label; and model parameters the probability that the predicted label is​ 5. A power grid intrusion detection method according to claim 4, characterized in that, After updating the model parameters in the initial machine learning model using the loss function corresponding to the pre-training task, the updated model parameters are: wherein: is a rate of weight decay to prevent overfitting; is a learning rate; is a gradient of the loss function, .

6. The method of grid intrusion detection of claim 1, wherein, The specific steps for obtaining the power grid intrusion prediction result are as follows: inputting the preprocessed data into the co-training post-feature embedding model to obtain a feature embedding vector ; obtaining the feature embedding vector a similarity with a preset positive class representative vector and the feature embedding vector a similarity with a preset negative class representative vector ; According to the similarity and the similarity , to obtain a power grid intrusion prediction result; wherein the power grid intrusion prediction result is: 。 7. A power grid intrusion detection system characterized by, The method of any one of claims 1 to 6 comprises the following modules: A pre-training module is configured to construct an initial machine learning model and pre-train the initial machine learning model using a public data set to obtain an initial feature embedding model; A co-training module is in communication connection with the pre-training module and is configured to obtain a small sample data set of a local power grid and co-train the initial feature embedding model using the small sample data set to obtain a co-trained feature embedding model; A result prediction module is in communication connection with the co-training module and is configured to obtain real-time operation data of the power grid and pre-process the power grid operation data to obtain pre-processed data; The preprocessed data is also input into the co-training feature embedding model to obtain a power grid intrusion prediction result. The preprocessed data is also input into the co-training feature embedding model to obtain a power grid intrusion prediction result.

Images