An attack detection method and device for an electric power private network and public network interaction node

Abstract

The application provides an attack detection method and device for an electric power private network and a public network interaction node, pre-processes each piece of traffic data obtained from a node to obtain target traffic data containing feature information, classifies all the target traffic data to obtain multiple category data sets, samples and optimizes the target traffic data in each category data set to obtain an optimized category data set, selects features for each feature information in the optimized category data set by using a mutual information feature selection algorithm to obtain a feature selection result, updates the optimized category data set according to the feature selection result, reduces the redundancy of the data in the optimized category data set, obtains a more refined to-be-detected traffic data set, shortens the time required for an attack detection classification model to detect the to-be-detected traffic data set, and improves the classification accuracy of the attack detection classification model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an attack detection method and apparatus for nodes interacting between a private power grid and the public network. Background Technology

[0002] The power industry is closely related to people's living standards. The development of the times and the advancement of technology have led to the emergence of numerous new business models in recent years, such as virtual power plants and load aggregators targeting wind power, photovoltaic power, electric vehicles, smart homes, and industrial and commercial parks. More and more distributed terminal resources are accessing the dedicated power network via the public network. However, in the context of frequent communication between the public network and the dedicated power network, malicious network attacks may seriously harm the dedicated power network through this open path, mainly manifested as the transmission of abnormal data through interactive nodes between the public network and the dedicated power network.

[0003] Therefore, to detect whether there are anomalies in the business data at interactive nodes, the commonly used detection method is to divide the dataset corresponding to the business data into multiple feature subsets and compare them with the attack detection threshold to determine whether it has been attacked. However, since the dataset contains massive amounts of data, this detection method takes a long time and has a low accuracy. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an attack detection method and apparatus for nodes interacting between a private power grid and the public network, in order to solve the problems of long detection time and low detection accuracy.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] The first aspect of this invention discloses an attack detection method for nodes interacting between a private power grid and a public network, the method comprising:

[0007] For each piece of traffic data obtained from a node, feature information characterizing the attributes of the traffic data is obtained from multiple fields of the traffic data, and target traffic data containing the feature information is generated. The node is an interactive node between the private power grid and the public grid.

[0008] Clustering algorithms are used to classify all the target traffic data to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data;

[0009] The target traffic data in each category dataset is sampled and optimized using a sampling method to obtain an optimized category dataset. The sampling method is pre-trained based on the sample traffic data.

[0010] For each feature in the optimized category dataset, a mutual information feature selection algorithm is used to select features and obtain the feature selection result.

[0011] Based on the feature selection results, the optimized category dataset is updated to obtain the traffic dataset to be detected;

[0012] The dataset to be detected is input into a pre-trained attack detection classification model to obtain the detection result. The attack detection classification model is pre-trained based on sample traffic data.

[0013] If the detection result indicates that the current traffic data to be detected is attack data, the current traffic data to be detected is processed according to preset preventive measures.

[0014] Preferably, the clustering algorithm is used to classify all the target traffic data to obtain multiple category datasets, including:

[0015] Clustering algorithms are used to classify all the target traffic data to obtain multiple initial category datasets, each containing multiple pieces of the target traffic data.

[0016] Count the number of target traffic data entries contained in each of the initial category datasets;

[0017] Based on the order of the number of items from largest to smallest, a preset number of the initial category datasets are selected and labeled as category datasets.

[0018] Preferably, the step of sampling and optimizing the target traffic data in each category dataset using a sampling method to obtain an optimized category dataset includes:

[0019] Several sampling ratio groups are generated using a sampling method, and each sampling ratio group contains a sampling ratio parameter corresponding to each category dataset;

[0020] Perform iterative operations to calculate the fitness value for each of the sampling proportion groups;

[0021] Adjust the sampling ratio parameter in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and determine the optimal sampling ratio parameter.

[0022] Based on the optimal sampling ratio parameter, the target traffic data in the corresponding category dataset is sampled and optimized to obtain the optimized category dataset.

[0023] Preferably, the step of performing feature selection using a mutual information feature selection algorithm for each feature information in the optimized category dataset to obtain the feature selection result includes:

[0024] For each feature information in the optimized category dataset, the feature information and the attack category are substituted into the conditional entropy formula to obtain the conditional entropy value corresponding to the attack category under the condition that the feature information exists. The attack categories include public network attack categories and private power grid attack categories.

[0025] Calculate the probability distribution function value corresponding to the attack category based on the probability distribution function, and substitute the probability distribution function value into the information entropy formula to calculate the information entropy value corresponding to the attack category;

[0026] The difference between the information entropy value and the conditional entropy value is calculated using the mutual information feature selection algorithm to obtain the correlation between the current feature information and the attack category;

[0027] The redundancy between the current feature information and the selected feature information is obtained by multiplying the correlation between the current feature information and the selected feature information by the reciprocal of the number of attack categories.

[0028] The feature selection result corresponding to the feature information is determined based on the difference between the relevance and the redundancy.

[0029] Preferably, the process of training an attack detection classification model based on sample traffic data includes:

[0030] For each piece of traffic data obtained from a node, feature information characterizing the attributes of the traffic data is obtained from multiple fields of the traffic data, and target traffic data containing the feature information is generated. The node is an interactive node between the private power grid and the public grid.

[0031] Clustering algorithms are used to classify all the target traffic data to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data;

[0032] A genetic algorithm is used to sample and optimize the target traffic data in each category dataset to obtain an optimized category dataset.

[0033] For each feature information in the optimized category dataset, the correlation between the current feature information and the attack category is calculated using the mutual information feature selection algorithm, and the redundancy between the current feature information and the selected feature information is also calculated. The attack categories include public network attack categories and private power grid attack categories.

[0034] The mutual information feature selection value corresponding to the feature information is determined based on the difference between the relevance and the redundancy.

[0035] The optimized category dataset is updated based on the selected values ​​of the mutual information features to obtain the sample dataset;

[0036] The sample dataset is input into the attack detection classification model to obtain the sample detection results;

[0037] Determine whether the sample detection result is the expected detection result;

[0038] If the sample detection result is the expected detection result, then the attack detection classification model is determined as the trained attack detection classification model;

[0039] If the sample detection result is not the expected detection result, the parameters of the attack detection classification model are adjusted, and the process returns to the step of inputting the sample dataset into the attack detection classification model to obtain the sample detection result.

[0040] A second aspect of this invention discloses an attack detection device for nodes interacting between a private power grid and a public network, the device comprising:

[0041] The first generation unit is used to obtain feature information representing the attributes of each flow data obtained from a node from multiple fields of the flow data, and generate target flow data containing the feature information. The node is an interactive node between the private power grid and the public grid.

[0042] The first classification unit is used to classify all the target traffic data using a clustering algorithm to obtain multiple category datasets, wherein each category dataset contains multiple pieces of the target traffic data;

[0043] The first optimization unit is used to sample and optimize the target traffic data in each category dataset using a sampling method to obtain an optimized category dataset. The sampling method is pre-trained based on the sample traffic data.

[0044] The feature selection unit is used to perform feature selection for each feature information in the optimized category dataset using a mutual information feature selection algorithm to obtain the feature selection result.

[0045] The first update unit is used to update the optimized category dataset according to the feature selection result to obtain the traffic dataset to be detected;

[0046] The detection unit is used to input the dataset to be detected into a pre-trained attack detection classification model to obtain the detection result. The attack detection classification model is pre-trained based on sample traffic data.

[0047] The processing unit is configured to process the current traffic data to be detected according to preset preventive measures if the detection result indicates that the current traffic data to be detected is attack data.

[0048] Preferably, the first classification unit includes:

[0049] The classification module is used to classify all the target traffic data using a clustering algorithm to obtain multiple initial category datasets, wherein the initial category datasets contain multiple target traffic data items;

[0050] The statistics module is used to count the number of target traffic data entries contained in each of the initial category datasets;

[0051] The selection module is used to select a preset number of the initial category datasets according to the order of the number of items from largest to smallest, and mark them as category datasets.

[0052] Preferably, the first optimization unit includes:

[0053] The generation module is used to generate several sampling ratio groups using a sampling method, and each sampling ratio group contains a sampling ratio parameter corresponding to each category dataset.

[0054] The calculation module is used to perform iterative operations and calculate the fitness value for each of the sampling proportion groups;

[0055] The first determining module is used to adjust the sampling ratio parameter in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and to determine the optimal sampling ratio parameter.

[0056] The optimization module is used to optimize the sampling of target traffic data in the corresponding category dataset according to the optimal sampling ratio parameter, so as to obtain an optimized category dataset.

[0057] Preferably, the feature selection unit includes:

[0058] The substitution module is used to substitute the feature information and the attack category into the conditional entropy formula for each feature information in the optimized category dataset to obtain the conditional entropy value corresponding to the attack category under the condition that the feature information exists. The attack categories include public network attack categories and power private network attack categories.

[0059] The calculation module is used to calculate the probability distribution function value corresponding to the attack category based on the probability distribution function, and substitute the probability distribution function value into the information entropy formula to calculate the information entropy value corresponding to the attack category;

[0060] The difference calculation module is used to calculate the difference between the information entropy value and the conditional entropy value using the mutual information feature selection algorithm, so as to obtain the correlation between the current feature information and the attack category;

[0061] The product module is used to multiply the current feature information and the selected feature information based on the correlation between the current feature information and the selected feature information, and the reciprocal of the number of attack categories, to obtain the redundancy between the current feature information and the selected feature information;

[0062] The second determining module is used to determine the feature selection result corresponding to the feature information based on the difference between the relevance and the redundancy.

[0063] Preferred options also include:

[0064] The second generation unit is used to obtain feature information representing the attributes of each flow data obtained from a node from multiple fields of the flow data, and generate target flow data containing the feature information. The node is an interactive node between the private power grid and the public grid.

[0065] The second classification unit is used to classify all the target traffic data using a clustering algorithm to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data;

[0066] The second optimization unit is used to sample and optimize the target traffic data in each category dataset using a genetic algorithm to obtain an optimized category dataset.

[0067] The second calculation unit is used to calculate the correlation between the current feature information and the attack category for each feature information in the optimized category dataset using a mutual information feature selection algorithm, and to calculate the redundancy between the current feature information and the selected feature information. The attack categories include public network attack categories and power private network attack categories.

[0068] The second determining unit is used to determine the mutual information feature selection value corresponding to the feature information based on the difference between the relevance and the redundancy.

[0069] The second update unit is used to update the optimized category dataset according to the value selected based on the mutual information feature to obtain the sample dataset;

[0070] The input unit is used to input the sample dataset into the attack detection classification model to obtain the sample detection results;

[0071] The judgment unit is used to determine whether the sample detection result is the expected detection result;

[0072] The third determining unit is used to determine the attack detection classification model as the trained attack detection classification model if the sample detection result is the expected detection result.

[0073] An adjustment unit is used to adjust the parameters of the attack detection classification model if the sample detection result is not the expected detection result, and then return to execute the input unit.

[0074] Based on the above embodiments of the present invention, an attack detection method and apparatus for interactive nodes between a private power grid and a public network are provided. For each traffic data obtained from a node, feature information characterizing the attributes of the traffic data is extracted from multiple fields of the traffic data, and target traffic data containing the feature information is generated. A clustering algorithm is used to classify all target traffic data, resulting in multiple category datasets. A genetic algorithm is used to sample and optimize the target traffic data in each category dataset, resulting in an optimized category dataset. For each feature information in the optimized category dataset, a mutual information feature selection algorithm is used to select features, resulting in feature selection results. Based on the feature selection results, the optimized category dataset is updated, reducing the redundancy of data in the optimized category dataset and obtaining a more refined traffic dataset to be detected. This facilitates shortening the time required for the attack detection classification model to detect the traffic dataset to be detected, while also improving the classification accuracy of the attack detection classification model. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0076] Figure 1 A flowchart illustrating an attack detection method for nodes interacting between a private power grid and a public network, provided as an embodiment of the present invention;

[0077] Figure 2 This is a flowchart illustrating the process of obtaining an optimized category dataset using a genetic algorithm for sampling optimization, as provided in an embodiment of the present invention.

[0078] Figure 3 A schematic diagram illustrating an attack detection method for nodes interacting between a private power grid and the public network, provided in an embodiment of the present invention;

[0079] Figure 4 Example diagrams of crossover and mutation operations provided in embodiments of the present invention;

[0080] Figure 5This is a structural block diagram of an attack detection device for a node interacting with a private power grid and a public network, provided in an embodiment of the present invention. Detailed Implementation

[0081] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0082] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0083] As the background technology indicates, commonly used detection methods typically divide the dataset corresponding to the business data into multiple feature subsets and compare them with attack detection thresholds to determine whether an attack has occurred. However, due to the massive number of distributed resource terminals and system access, the datasets in new power business systems contain massive amounts of data, making the detection time using this method long and the accuracy low.

[0084] Therefore, embodiments of the present invention provide an attack detection method and apparatus for nodes interacting between a private power grid and the public network. The method involves preprocessing each traffic data obtained from the node to obtain target traffic data containing feature information; classifying all target traffic data to obtain multiple category datasets; sampling and optimizing the target traffic data in each category dataset to obtain an optimized category dataset; using a mutual information feature selection algorithm to select features for each feature in the optimized category dataset to obtain feature selection results; and updating the optimized category dataset based on the feature selection results. This reduces the redundancy of data in the optimized category dataset, resulting in a more refined traffic dataset to be detected. This facilitates shortening the time required for the attack detection classification model to detect the traffic dataset to be detected, while also improving the classification accuracy of the attack detection classification model.

[0085] See Figure 1 The flowchart illustrates an attack detection method for a node interacting with a private power grid and a public network, according to an embodiment of the present invention. The attack detection method includes:

[0086] Step S101: For each piece of traffic data obtained from the node, extract feature information representing the attributes of the traffic data from multiple fields of the traffic data, and generate target traffic data containing the feature information.

[0087] It should be noted that the node is an interactive node between the private power grid and the public power grid.

[0088] Understandably, in order to attack and damage data and services in new power business systems, attackers typically transmit abnormal data through nodes between the public network and the power private network. During data interaction between the power private network and the public network, traffic data enters the power private network coordination center through isolation and protection devices. Therefore, the traffic data obtained in this embodiment of the invention is traffic data that has passed through the isolation and protection devices.

[0089] In the specific implementation step S101, traffic data is obtained from the interaction node between the private power grid and the public network. For each piece of traffic data, all fields in the traffic data are parsed (for example, the traffic data is parsed using the packet parsing tool Wireshark). Fields that characterize the attributes of the traffic data are obtained from multiple fields of the traffic data, marked as feature information, and target traffic data containing feature information is generated.

[0090] For example, for each piece of traffic data obtained from a node, the traffic data is parsed to obtain 80 fields. From the 80 fields, 18 fields that represent the attributes of the traffic data are selected, marked as feature information, and target traffic data containing only 18 feature information is generated.

[0091] It is understandable that each piece of traffic data obtained from a node has the following characteristics:

[0092] Because devices on a dedicated power grid typically request or upload data at fixed intervals, the traffic data is periodic; because devices on a dedicated power grid typically request or upload data to designated devices, the IP addresses of the traffic data are relatively fixed; at the same time, the length range of the message data transmitted in a dedicated power grid is relatively narrow, but the data transmission efficiency is relatively high.

[0093] Therefore, the specific process of extracting fields representing the attributes of traffic data from multiple fields (as shown in Table 1) and marking these fields as feature information includes, for example, selecting the time field ts as the feature information of traffic periodicity; and selecting src_ip, des_ip, src_port, and des_port of the IP address field as the feature information of traffic address. Simultaneously, a time window is selected based on data granularity requirements, real-time requirements, data storage and processing feasibility, monitoring objectives, and analysis needs. Statistical analysis is then performed on the traffic data contained within the time window to establish statistical characteristics including the duration of the data stream within the time window, the average time between two data packets sent in the data stream, the average size of the data packets, and the private network protocol fields. Here, a time window refers to a fixed time period for dividing and processing traffic data from a time dimension.

[0094] Table 1

[0095]

[0096]

[0097] Understandably, to address the issue of unbalanced target traffic data, the following steps S102 and S103 reduce the number of target traffic data categories with a larger quantity, thereby making the entire dataset more balanced.

[0098] Step S102: Use a clustering algorithm to classify all target traffic data to obtain multiple category datasets.

[0099] In the specific implementation step S102, a clustering algorithm (such as the K-means algorithm) is used to classify all target traffic data, and similar traffic data are grouped into the same category to obtain multiple initial category datasets. Each initial category dataset contains multiple target traffic data. From the multiple initial category datasets, a preset number (e.g., 6) of initial category datasets containing the most target traffic data are selected and marked as category datasets. In other words, the category dataset contains multiple target traffic data.

[0100] Specifically, the process of selecting a preset number of initial category datasets containing the most target traffic data from multiple initial category datasets and marking them as category datasets is as follows: count the number of target traffic data entries contained in each initial category dataset; select a preset number (e.g., 6) of initial category datasets according to the order of the number of entries from largest to smallest, and mark them as category datasets.

[0101] It should be noted that these six dataset categories can be Normal, Fuzzers (anomaly type 1), Reconnaissance (anomaly type 2), Exploit (anomaly type 3), DoS (anomaly type 4), and Generic (anomaly type 5) datasets. The Normal dataset contains data from the normal operation of the power grid; the Fuzzers dataset contains malicious packets simulating legitimate input to test the system's ability to handle abnormal or malicious input; the Reconnaissance dataset contains traffic data related to port scanning, network probing, or information gathering; the Exploit dataset contains one type of anomaly—attacks exploiting vulnerabilities. This dataset contains attack attempts targeting known vulnerabilities or weaknesses in the power grid; the DoS dataset contains traffic data related to denial-of-service attacks in the power grid; and the Generic dataset refers to other types of anomalous behavior that cannot be explicitly defined as one of the above specific types.

[0102] Step S103: Use sampling methods to optimize the target traffic data in each category dataset to obtain the optimized category dataset.

[0103] In the specific implementation step S103, a sampling ratio is set for each category dataset using a sampling method (such as a genetic algorithm). The sampling ratio is adjusted to optimize the sampling of target traffic data in the category dataset, resulting in optimized category datasets with different numbers of samples.

[0104] It should be noted that the sampling method is pre-trained based on sample traffic data. In the specific implementation, the sampling optimization algorithm based on genetic algorithm provided in Table 2 below can be used to optimize the sampling of target traffic data in each category dataset, thereby obtaining an optimized category dataset.

[0105] Table 2

[0106]

[0107]

[0108] It should be noted that, taking a six-category dataset as an example, the specific implementation method of using a genetic algorithm to sample and optimize the target traffic data in each category dataset to obtain the optimized category dataset is detailed in the following embodiments of the present invention. Figure 2 The content in [the document / article].

[0109] Step S104: For each feature information in the optimized category dataset, use the mutual information feature selection algorithm to select features and obtain the feature selection results.

[0110] Step S104: For each feature information in the optimized category dataset, use the mutual information feature selection algorithm to calculate the correlation between the current feature information and the attack category, and calculate the redundancy between the current feature information and the selected feature information.

[0111] It should be noted that the attack categories include public network attacks and private power network attacks. Attack methods on private networks mainly include spoofing attacks and fuzzing attacks, while attack methods on public networks mainly include denial-of-service attacks, man-in-the-middle attacks, replay attacks, and bypass control.

[0112] It is understandable that the target traffic data in the optimized category dataset still suffers from high data dimensionality and redundancy. To further improve the detection efficiency of attack detection on nodes interacting with the power private network and the public network, the public network attack category and the power private network attack category are used as two influencing factors to calculate the mutual information feature selection value.

[0113] In the specific implementation of step S104, for each feature information in the optimized category dataset, the mutual information feature selection algorithm is used to calculate the correlation between the current feature information and the public network attack category, the correlation between the current feature information and the power private network attack category, and the redundancy between the current feature information and the selected feature information.

[0114] Understandably, feature selection is determined by the amount of information gain brought by a particular feature. Information entropy H uses a numerical expression to describe the uncertainty of a variable, reflecting the amount of information carried by the variable. The following section provides a detailed explanation of step S104 in conjunction with processes A1 to A4:

[0115] It should be noted that C1 = {c 11 ,c 12 ,...,c 1l} represents the public network attack category; define C2 = {c 21 ,c 22 ,...,c 2m} indicates the category of attacks on private power grids.

[0116] A1: For each feature in the optimization category dataset, substitute the feature and the attack category into the conditional entropy formula to obtain the conditional entropy value corresponding to the attack category under the condition that the feature exists.

[0117] It is understandable that we determine the probability distribution function p(F) of each feature information vector F (e.g., 18 features) in the optimization category dataset; and calculate the conditional probability distribution function corresponding to the attack category under the condition that the feature information exists, based on the conditional probability distribution function, denoted as P(Ci|f), i=1,2.

[0118] Substitute p(F) and P(C1|f) into the conditional entropy formula (1) to calculate the conditional entropy H(C1|F) corresponding to the public network attack category under the condition that the feature information exists; and substitute p(F) and P(C2|f) into the conditional entropy formula (2) to calculate the conditional entropy H(C2|F) corresponding to the power private network attack category under the condition that the feature information exists.

[0119] H(C1|F)=-∑ f∈F p(f)∑ c1∈C1 p(c1|f)logp(c1|f) (1)

[0120] H(C2|F)=-∑ f∈F p(f)∑ c2∈C2 p(c2|f)logp(c2|f) (2)

[0121] A2: Calculate the probability distribution function value corresponding to the attack category based on the probability distribution function, and substitute the probability distribution function value into the information entropy formula to calculate the information entropy value corresponding to the attack category.

[0122] It is understandable that, based on the probability distribution function, the probability distribution function value corresponding to the attack category is calculated, then P(C1)={p(c 11 ),p(c 12 ),....,p(c 1l )} represents the probability distribution function value of public network attack categories, P(C2)={p(c 21 ),p(c 22 ),....,p(c 2m )} represents the probability distribution function value of the power grid attack category.

[0123] Substituting the probability distribution function value into the information entropy formula (3), the information entropy value corresponding to the attack category is calculated as follows:

[0124] H(Ci)=-∑ cj＝Ci p(cj)logp(cj),i=1,2 (3)

[0125] Where p(cj) is the probability distribution function of the attack category. The information entropy H(C1) of the public network attack category and the information entropy H(C2) of the power private network attack category can be obtained through formula (3).

[0126] A3: Calculate the difference between the information entropy value and the conditional entropy value using the mutual information feature selection algorithm to obtain the correlation between the current feature information and the attack category.

[0127] Specifically, the information entropy H(C1) of the public network attack category is calculated according to formula (4), and the conditional entropy H(C1|F) of the public network attack category under the condition that feature information exists is used to obtain the correlation I(C1;F) between the current feature information and the public network attack category.

[0128]

[0129] The difference between the information entropy H(C2) of the power grid attack category and the conditional entropy H(C2|F) of the power grid attack category under the condition that the feature information exists is calculated according to formula (5), and the correlation between the current feature information and the power grid attack category is obtained as I(C2;F).

[0130]

[0131] A4: The redundancy between the current feature information and the selected feature information is obtained by multiplying the correlation between the current feature information and the selected feature information by the reciprocal of the number of attack categories.

[0132] Understandably, different numbers of attack categories have different impacts on the redundancy between data features.

[0133] Specifically, the redundancy R1 between the current feature information and the selected feature information corresponding to the public network attack category is calculated according to formula (6). S represents the selected feature information.

[0134]

[0135] The redundancy R2 between the current feature information and the selected feature information corresponding to the power grid attack category is calculated according to formula (7). S represents the selected feature information.

[0136]

[0137] Step S105: Determine the mutual information feature selection value corresponding to the feature information based on the difference between relevance and redundancy.

[0138] In the specific implementation of step S105, the correlation between the current feature information and the public network attack category and the correlation between the current feature information and the power private network attack category are summed, and then their respective redundancy is subtracted.

[0139] For example, as shown in formula (8), where, and These are the reciprocals of the number of public network attack categories and the reciprocals of the number of private power grid attack categories, respectively.

[0140]

[0141] That is, to obtain the mutual information feature selection value J of the current feature information. MIFS (fi).

[0142] In the specific implementation process, the mutual information feature selection value corresponding to the feature information can be determined by combining the mutual information feature selection algorithm provided in Table 3 below.

[0143] Table 3

[0144]

[0145] Step S105: Update the optimized category dataset based on the feature selection results to obtain the traffic dataset to be detected.

[0146] In the specific implementation step S105, the mutual information feature selection value of each feature information is compared with a preset threshold. When the mutual information feature selection value is greater than the preset threshold, the current feature information is added to a new feature set (e.g., feature set S). The optimized category dataset is updated according to the feature set to obtain the traffic dataset to be detected.

[0147] In other words, the dataset of the process to be detected contains only |S| feature information.

[0148] Step S106: Input the dataset to be detected into the attack detection classification model to obtain the detection results.

[0149] It should be noted that the attack detection classification model is pre-trained based on sample traffic data. Specifically, the process of training the attack detection classification model based on sample traffic data is as follows: For each piece of traffic data obtained from a node, feature information representing the attributes of the traffic data is extracted from multiple fields of the traffic data, and target traffic data containing feature information is generated; all target traffic data are classified using a clustering algorithm to obtain multiple category datasets; the target traffic data in each category dataset is sampled and optimized using a genetic algorithm to obtain an optimized category dataset; for each feature information in the optimized category dataset, the correlation between the current feature information and the attack category is calculated using a mutual information feature selection algorithm, as well as the correlation between the current feature information and the selected feature information. The redundancy between relevance and redundancy is determined; the mutual information feature selection value corresponding to the feature information is determined based on the difference between relevance and redundancy; the optimized category dataset is updated based on the mutual information feature selection value to obtain the sample dataset; the sample dataset is input into the attack detection classification model to obtain the sample detection result; it is determined whether the sample detection result is the expected detection result; if the sample detection result is the expected detection result, the attack detection classification model is determined as the trained attack detection classification model; if the sample detection result is not the expected detection result, the parameters of the attack detection classification model are adjusted, and the process returns to the step of inputting the sample dataset into the attack detection classification model to obtain the sample detection result.

[0150] Specifically, in combination Figure 3 The content shown involves collecting data at the interaction nodes between the public network and the private network in the first stage 100. Specifically, new business data such as 5G network data, power communication data, and new energy vehicle data enter the coordination and control center through the isolation and protection device. These traffic data are then preprocessed and sent to the second stage 200.

[0151] In the second stage 200, the preprocessed traffic data is sampled based on a genetic algorithm. Specifically, random sampling is performed from the preprocessed traffic data, and the fitness value is calculated. Crossover and mutation operations are performed based on the fitness value. After iterating n times, the optimal sampling ratio parameter is obtained. The preprocessed traffic data is then sampled and optimized based on the optimal sampling ratio parameter to obtain the optimal sample data. The optimal sample data is then sent to the third stage 300.

[0152] In the third stage 300, the redundancy of the optimal sample data is eliminated based on the mutual information feature selection algorithm. Specifically, the optimal sample data, the public network attack type, and the power private network attack type are used as input parameters of the mutual information feature selection algorithm to obtain the sample dataset.

[0153] In the fourth stage 400, an attack detection classification model is trained using the sample dataset, and then the trained attack detection classification model is applied to carry out subsequent attack detection.

[0154] Step S107: If the detection result indicates that the current traffic data to be detected is attack data, process the current traffic data to be detected according to the preset prevention measures.

[0155] In the specific implementation of step S107, if the detection result indicates that the current traffic data to be detected is attack data, the current traffic data to be detected can be processed according to preset preventive measures (such as isolation, enhanced access control, encrypted communication and enhanced security configuration).

[0156] Isolation refers to separating the nodes interacting with the power grid's private network and the public network from other systems to limit attackers' access. This can be achieved through physical isolation, network isolation, and virtual private networks (VPNs). Strengthened access control involves implementing robust access control mechanisms, including strict authentication, permission management, and role assignment. This ensures that only authorized personnel can access and operate the nodes interacting with the power grid's private network and the public network. Encrypted communication uses encryption technology to protect communication between the power grid's private network and the public network. Secure protocols and encryption algorithms, such as SSL / TLS, are employed to protect the confidentiality and integrity of data during transmission. Enhanced security configuration involves configuring the nodes interacting with the power grid's private network and the public network securely, including disabling unnecessary services and ports, updating system and application patches, and configuring firewalls and intrusion detection / prevention systems.

[0157] In this embodiment of the invention, the original traffic data is preprocessed and optimized in both horizontal and vertical dimensions. Horizontally, a genetic algorithm is used to determine the optimized category dataset from the preprocessed traffic data. In the genetic algorithm-based data sampling optimization algorithm, a random sampling algorithm is used to sample data from a large number of categories. The genetic algorithm serves as the search strategy to optimize the sampling ratio parameter in each category, obtaining the optimal ratio parameter for sampling the dataset. This results in a training dataset with a small number of categories and balanced data, improving the accuracy of intrusion detection and reducing the false positive rate. Vertically, a mutual information feature selection algorithm is used to calculate the correlation between each feature in the optimized category dataset and the attack category, as well as the redundancy between each feature and the selected features. The optimized category dataset is then updated based on the correlation and redundancy, reducing the redundancy of the data and obtaining a more refined traffic dataset to be detected. This shortens the detection time. Simultaneously, the sample dataset is used to train an attack detection classification model to improve the classification accuracy of the attack detection classification model.

[0158] The above embodiments of the present invention Figure 1The method described in the article involves using a genetic algorithm to sample and optimize the target traffic data in each category dataset, resulting in an optimized category dataset. See [link to relevant documentation]. Figure 2 The diagram illustrates a flowchart of an embodiment of the present invention, which shows the process of obtaining an optimized category dataset by sampling optimization using a genetic algorithm.

[0159] It should be noted that the purpose of this embodiment of the invention is to determine the optimal sampling ratio for each category dataset, and to optimize the sampling of target traffic data in each category dataset to obtain an optimized category dataset. The optimal sampling ratio can be a positive real number between 0 and 1. Therefore, in this embodiment of the invention, floating-point encoding is used as the chromosome encoding format in the genetic algorithm to avoid frequent binary and decimal conversions.

[0160] Taking a six-category dataset as an example, an optimized category dataset is obtained by using a genetic algorithm for sampling optimization, including:

[0161] Step S201: Generate several sampling proportion groups using a genetic algorithm.

[0162] In the specific implementation step S201, a genetic algorithm is used to generate m sampling proportion groups X. Each sampling proportion group X contains the sampling proportion parameter corresponding to each category dataset.

[0163] For example, using a 6-tuple, each sampling proportion group X = {r1,r2,r3,r4,r5,r6}, where ri ∈ (0,1] is the sampling proportion parameter corresponding to the i-th category dataset; 0 and 1 represent the lower limit and upper limit value of the sampling proportion parameter, respectively.

[0164] Step S202: Perform the iterative operation to calculate the fitness value for each sampling proportion group.

[0165] In the specific implementation step S202, an iterative operation is performed to calculate the fitness value of each sampling proportion group X, so as to perform selection, crossover and mutation operations based on the fitness value until the fitness value of each category dataset reaches the threshold requirement or the maximum number of iterations.

[0166] It is understandable that the larger the fitness value of a sampling proportion group, the greater the likelihood that the sampling proportion group will be selected for crossover and mutation operations.

[0167] It should be noted that, in this embodiment of the invention, the fitness value of the sampling proportion group is defined as the classification accuracy of the dataset after the sampling proportion group obtains the sampled dataset and uses a classifier to classify the dataset; the fitness value of the sampling proportion group is calculated according to formula (9) as follows:

[0168]

[0169] Among them, yr TN represents the number of samples in class r, n represents the total number of classes, i.e., the length of each sampling proportion group, TP (True positive) refers to the number of samples correctly classified as normal, and TN represents the number of samples correctly classified as normal. i (Truenegative) refers to the number of samples that are correctly classified as the i-th anomaly category.

[0170] Step S203: Adjust the sampling ratio parameter in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and determine the optimal sampling ratio parameter.

[0171] In the specific implementation step S203, a selection operation is performed based on the fitness value. The selection operation adopts the roulette wheel method, selecting two sampling ratio groups to enter the crossover and mutation operations. Crossover and mutation are performed to adjust the sampling ratio parameters in the sampling ratio groups until the current iteration number has reached the preset maximum iteration number, and the optimal sampling ratio parameters are determined.

[0172] Understandably, in the roulette wheel method, sampling proportion groups with higher fitness values ​​are more likely to be selected. Furthermore, because the sampling proportion groups use numerical encoding, crossover and mutation operations are performed using numerical calculations.

[0173] The crossover operation will be explained below based on formulas (10) to (12).

[0174]

[0175] t i =1-q i ,i∈{1,2,...,n} (11)

[0176] Where, q i t represents the ratio of the number of samples in the data category represented by the i-th sampling position to the total number of samples. i This represents the crossover probability at the i-th gene position.

[0177] Specifically, for each sampling ratio i, a random number p in the interval [0,1] is generated. i According to p i with t i The size determines whether a crossover operation occurs in the sampling proportion i. Based on the above formula, the smaller the number of samples in each category dataset, the higher the probability of crossover, thus achieving diversification of sampling proportion groups more quickly.

[0178] The value of the crossover offspring obtained after calculating the sampling ratio group according to formula (12) and performing the crossover operation is set with parameter β, β∈(0,1). The crossover result has more possibilities, thereby achieving the goal of searching for the optimal sampling ratio group faster and preventing overfitting.

[0179]

[0180] Among them, w i a represents the descendant value after the intersection of the i-th sampling proportion positions. i b represents the value of the i-th sampling proportion position of parent generation 1. i This represents the value at the i-th sampling ratio position of parent generation 2.

[0181] After the crossover operation is performed on each sampling proportion group, the mutation operation is performed. The mutation operation is explained below according to formulas (13) to (16).

[0182] Specifically, based on the classification accuracy Pre for each category i i (Precision, Pre) and the percentage of samples in this category q i Based on this information, a mutation operation is performed. Specifically, when the classification precision of a certain category is the lowest and its sample size is less than the median percentage (q) of all categories... median Or greater than the median q median If so, the sampling proportion for this type will be increased by 10% or decreased by 10%.

[0183]

[0184]

[0185]

[0186]

[0187] Among them, Pr e min q represents the minimum classification precision for each category. median This represents the median percentage of all categories. FP i (False positive) refers to the number of samples in category i that are misclassified as other categories.

[0188] It should be noted that example diagrams of crossover and mutation operations are provided in the embodiments of this invention. Figure 4 As shown, assuming the selection operation selects two chromosomes X1 (i.e., sampling proportion group X1) and X2 (i.e., sampling proportion group X2), since X1 has a higher fitness value, the crossover and mutation operations for X1 and X2 are as follows: Figure 4 As shown.

[0189] Step S204: Optimize the sampling of the corresponding category dataset according to the optimal sampling ratio parameter to obtain the optimized category dataset.

[0190] In the specific implementation step S204, the optimal sampling ratio parameter calculated based on the genetic algorithm is used to optimize the sampling of the corresponding category dataset to obtain the optimized category dataset.

[0191] In this embodiment of the invention, the category dataset is further sampled and optimized into an optimized category dataset based on clustering and genetic algorithms, resulting in an optimized category dataset with a small number of samples and balanced categories. This improves the accuracy of dataset intrusion detection and reduces the false alarm rate.

[0192] Corresponding to the attack detection method for the interaction node between a private power network and the public network provided in the above embodiments of the present invention, see also... Figure 5 This invention illustrates an attack detection device for a node interacting with a private power grid and a public network, provided by an embodiment of the present invention. The attack detection device includes: a first generation unit 501, a first classification unit 502, a first optimization unit 503, a first calculation unit 504, a first determination unit 505, a first update unit 506, a detection unit 507, and a processing unit 508.

[0193] The first generation unit 501 is used to obtain feature information representing the attributes of the traffic data from multiple fields of each traffic data obtained from the node, and generate target traffic data containing the feature information. The node is an interactive node between the private power grid and the public grid.

[0194] The first classification unit 502 is used to classify all target traffic data using a clustering algorithm to obtain multiple category datasets, each containing multiple target traffic data.

[0195] The first optimization unit 503 is used to sample and optimize the target traffic data in each category dataset using a genetic algorithm to obtain an optimized category dataset.

[0196] The first calculation unit 504 is used to calculate the correlation between the current feature information and the attack category for each feature information in the optimization category dataset using the mutual information feature selection algorithm, and to calculate the redundancy between the current feature information and the selected feature information. The attack categories include public network attack categories and power private network attack categories.

[0197] The first determining unit 505 is used to determine the mutual information feature selection value corresponding to the feature information based on the difference between the relevance and redundancy.

[0198] The first update unit 506 is used to select values ​​based on mutual information features to update the optimized category dataset and obtain the traffic dataset to be detected.

[0199] The detection unit 507 is used to input the dataset to be detected into the attack detection classification model to obtain the detection result. The attack detection classification model is pre-trained based on sample traffic data.

[0200] The processing unit 508 is used to process the current traffic data to be detected according to preset preventive measures if the detection result indicates that the current traffic data to be detected is attack data.

[0201] In this embodiment of the invention, the original traffic data is preprocessed, and an optimized category dataset is determined from the preprocessed traffic data. For each feature information in the optimized category dataset, a mutual information feature selection algorithm is used to select features and obtain feature selection results. Based on the feature selection results, the optimized category dataset is updated, which reduces the redundancy of the data in the optimized category dataset and obtains a more refined traffic dataset to be detected, thereby shortening the detection time. At the same time, the attack detection classification model is trained using the sample dataset to improve the classification accuracy of the attack detection classification model.

[0202] Preferred, combined Figure 5 The content shown indicates that the first classification unit 502 includes a classification module, a statistics module, and a selection module; the implementation principles of each module are as follows:

[0203] The classification module is used to classify all target traffic data using a clustering algorithm, resulting in multiple initial category datasets, each containing multiple target traffic data entries.

[0204] The statistics module is used to count the number of target traffic data entries contained in each initial category dataset.

[0205] The selection module is used to select a preset number of initial category datasets in descending order of the number of entries, and label them as category datasets.

[0206] Preferred, combined Figure 5 The first optimization unit 503, as shown, includes a generation module, a calculation module, a determination module, and an optimization module; the implementation principles of each module are as follows:

[0207] The generation module is used to generate several sampling proportion groups using a genetic algorithm. Each sampling proportion group contains the sampling proportion parameters corresponding to each category dataset.

[0208] The calculation module is used to perform iterative operations and calculate the fitness value for each sampling proportion group.

[0209] The determination module is used to adjust the sampling ratio parameters in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and to determine the optimal sampling ratio parameters.

[0210] The optimization module is used to optimize the sampling of the corresponding category datasets based on the optimal sampling ratio parameters, resulting in optimized category datasets.

[0211] Preferred, combined Figure 5 The first calculation unit 504, as shown, includes a substitution module, a calculation module, a difference calculation module, and a product calculation module; the implementation principles of each module are as follows:

[0212] The substitution module is used to substitute the feature information and attack category into the conditional entropy formula for each feature information in the optimization category dataset, so as to obtain the conditional entropy value corresponding to the attack category under the condition that the feature information exists.

[0213] The calculation module is used to calculate the probability distribution function value corresponding to the attack category based on the probability distribution function, and then substitute the probability distribution function value into the information entropy formula to calculate the information entropy value corresponding to the attack category.

[0214] The difference calculation module is used to calculate the difference between the information entropy value and the conditional entropy value using the mutual information feature selection algorithm, so as to obtain the correlation between the current feature information and the attack category.

[0215] The product module is used to calculate the redundancy between the current feature information and the selected feature information by multiplying them based on the correlation between the current feature information and the selected feature information, as well as the reciprocal of the number of attack categories.

[0216] Preferred, combined Figure 5 As shown, the attack detection device also includes a second generation unit, a second classification unit, a second optimization unit, a second calculation unit, a second determination unit, a second update unit, an input unit, a judgment unit, a third determination unit, and an adjustment unit.

[0217] The second generation unit is used to extract feature information representing the attributes of each flow data obtained from the node from multiple fields of the flow data, and generate target flow data containing the feature information. The node is an interactive node between the private power grid and the public grid.

[0218] The second classification unit is used to classify all target traffic data using a clustering algorithm, resulting in multiple category datasets, each containing multiple target traffic data entries.

[0219] The second optimization unit is used to sample and optimize the target traffic data in each category dataset using a genetic algorithm to obtain an optimized category dataset.

[0220] The second calculation unit is used to calculate the correlation between the current feature information and the attack category for each feature information in the optimized category dataset using the mutual information feature selection algorithm, and to calculate the redundancy between the current feature information and the selected feature information. The attack categories include public network attack categories and private power grid attack categories.

[0221] The second determining unit is used to determine the mutual information feature selection value corresponding to the feature information based on the difference between the relevance and redundancy.

[0222] The second update unit is used to select values ​​based on mutual information features to update the optimized category dataset and obtain the sample dataset.

[0223] The input unit is used to input the sample dataset into the attack detection classification model to obtain the sample detection results.

[0224] The judgment unit is used to determine whether the sample detection result is the expected detection result.

[0225] The third determining unit is used to determine the attack detection classification model as the trained attack detection classification model if the sample detection result is the expected detection result.

[0226] The adjustment unit is used to adjust the parameters of the attack detection classification model if the sample detection result is not the expected detection result, and then return to the execution input unit.

[0227] In summary, this invention provides an attack detection method and apparatus for nodes interacting between a private power grid and the public network. The method preprocesses the original traffic data, determines an optimized category dataset from the preprocessed traffic data, and uses a mutual information feature selection algorithm to select features for each feature in the optimized category dataset, obtaining the feature selection result. Based on the feature selection result, the optimized category dataset is updated, reducing the redundancy of the data in the optimized category dataset and obtaining a more refined traffic dataset to be detected, thus shortening the detection time. Simultaneously, the attack detection classification model is trained using the sample dataset to improve the classification accuracy of the attack detection classification model.

[0228] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0229] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0230] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting attacks on nodes interacting between a private power grid and a public network, characterized in that, The method includes: For each piece of traffic data obtained from a node, feature information characterizing the attributes of the traffic data is obtained from multiple fields of the traffic data, and target traffic data containing the feature information is generated. The node is an interactive node between the private power grid and the public grid. Clustering algorithms are used to classify all the target traffic data to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data; The target traffic data in each category dataset is sampled and optimized using a sampling method to obtain an optimized category dataset. The sampling method is pre-trained based on the sample traffic data. For each feature information in the optimized category dataset, the feature information and the attack category are substituted into the conditional entropy formula to obtain the conditional entropy value corresponding to the attack category under the condition that the feature information exists. The attack categories include public network attack categories and power private network attack categories. The probability distribution function value corresponding to the attack category is calculated according to the probability distribution function, and the probability distribution function value is substituted into the information entropy formula to calculate the information entropy value corresponding to the attack category. The difference between the information entropy value and the conditional entropy value is calculated using the mutual information feature selection algorithm to obtain the correlation between the current feature information and the attack category. The redundancy between the current feature information and the selected feature information is obtained by multiplying the correlation between the current feature information and the selected feature information by the reciprocal of the number of attack categories. The feature selection result corresponding to the feature information is determined according to the difference between the correlation and the redundancy. Based on the feature selection results, the optimized category dataset is updated to obtain the traffic dataset to be detected; The attack detection classification model is pre-trained based on sample traffic data and the target traffic dataset is input into it to obtain the detection results. If the detection result indicates that the current traffic data to be detected is attack data, the current traffic data to be detected is processed according to preset preventive measures.

2. The method according to claim 1, characterized in that, The clustering algorithm is used to classify all the target traffic data, resulting in multiple category datasets, including: Clustering algorithms are used to classify all the target traffic data to obtain multiple initial category datasets, each containing multiple pieces of the target traffic data. Count the number of target traffic data entries contained in each of the initial category datasets; Based on the order of the number of items from largest to smallest, a preset number of the initial category datasets are selected and labeled as category datasets.

3. The method according to claim 1, characterized in that, The step of sampling and optimizing the target traffic data in each category dataset using a sampling method to obtain an optimized category dataset includes: Several sampling ratio groups are generated using a sampling method, and each sampling ratio group contains a sampling ratio parameter corresponding to each category dataset; Perform iterative operations to calculate the fitness value for each of the sampling proportion groups; Adjust the sampling ratio parameter in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and determine the optimal sampling ratio parameter. Based on the optimal sampling ratio parameter, the target traffic data in the corresponding category dataset is sampled and optimized to obtain the optimized category dataset.

4. The method according to claim 1, characterized in that, The process of training an attack detection and classification model based on sample traffic data includes: For each piece of traffic data obtained from a node, feature information characterizing the attributes of the traffic data is obtained from multiple fields of the traffic data, and target traffic data containing the feature information is generated. The node is an interactive node between the private power grid and the public grid. Clustering algorithms are used to classify all the target traffic data to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data; A genetic algorithm is used to sample and optimize the target traffic data in each category dataset to obtain an optimized category dataset. For each feature information in the optimized category dataset, the correlation between the current feature information and the attack category is calculated using the mutual information feature selection algorithm, and the redundancy between the current feature information and the selected feature information is also calculated. The attack categories include public network attack categories and private power grid attack categories. The mutual information feature selection value corresponding to the feature information is determined based on the difference between the relevance and the redundancy. The optimized category dataset is updated based on the selected values ​​of the mutual information features to obtain the sample dataset; The sample dataset is input into the attack detection classification model to obtain the sample detection results; Determine whether the sample detection result is the expected detection result; If the sample detection result is the expected detection result, then the attack detection classification model is determined as the trained attack detection classification model; If the sample detection result is not the expected detection result, the parameters of the attack detection classification model are adjusted, and the process returns to the step of inputting the sample dataset into the attack detection classification model to obtain the sample detection result.

5. An attack detection device for nodes interacting between a private power grid and a public network, characterized in that, The device includes: The first generation unit is used to obtain feature information representing the attributes of each flow data obtained from a node from multiple fields of the flow data, and generate target flow data containing the feature information. The node is an interactive node between the private power grid and the public grid. The first classification unit is used to classify all the target traffic data using a clustering algorithm to obtain multiple category datasets, wherein each category dataset contains multiple pieces of the target traffic data; The first optimization unit is used to sample and optimize the target traffic data in each category dataset using a sampling method to obtain an optimized category dataset. The sampling method is pre-trained based on the sample traffic data. The feature selection unit includes: a substitution module, a calculation module, a difference calculation module, a product calculation module, and a second determination module; The substitution module is used to substitute the feature information and the attack category into the conditional entropy formula for each feature information in the optimized category dataset to obtain the conditional entropy value corresponding to the attack category under the condition that the feature information exists. The attack categories include public network attack categories and power private network attack categories. The calculation module is used to calculate the probability distribution function value corresponding to the attack category based on the probability distribution function, and substitute the probability distribution function value into the information entropy formula to calculate the information entropy value corresponding to the attack category. The difference calculation module is used to calculate the difference between the information entropy value and the conditional entropy value using the mutual information feature selection algorithm, so as to obtain the correlation between the current feature information and the attack category. The product module is used to multiply the current feature information and the selected feature information based on the correlation between the current feature information and the selected feature information, and the reciprocal of the number of attack categories, to obtain the redundancy between the current feature information and the selected feature information. The second determining module is used to determine the feature selection result corresponding to the feature information based on the difference between the relevance and the redundancy. The first update unit is used to update the optimized category dataset according to the feature selection result to obtain the traffic dataset to be detected; The detection unit is used to input the traffic dataset to be detected into a pre-trained attack detection classification model to obtain the detection result. The attack detection classification model is pre-trained based on the sample traffic data. The processing unit is configured to process the current traffic data to be detected according to preset preventive measures if the detection result indicates that the current traffic data to be detected is attack data.

6. The apparatus according to claim 5, characterized in that, The first classification unit includes: The classification module is used to classify all the target traffic data using a clustering algorithm to obtain multiple initial category datasets, wherein the initial category datasets contain multiple target traffic data items; The statistics module is used to count the number of target traffic data entries contained in each of the initial category datasets; The selection module is used to select a preset number of the initial category datasets according to the order of the number of items from largest to smallest, and mark them as category datasets.

7. The apparatus according to claim 5, characterized in that, The first optimization unit includes: The generation module is used to generate several sampling ratio groups using a sampling method, and each sampling ratio group contains a sampling ratio parameter corresponding to each category dataset. The calculation module is used to perform iterative operations and calculate the fitness value for each of the sampling proportion groups; The first determining module is used to adjust the sampling ratio parameter in the sampling ratio group according to the fitness value until the current iteration number has reached the preset maximum iteration number, and to determine the optimal sampling ratio parameter. The optimization module is used to optimize the sampling of target traffic data in the corresponding category dataset according to the optimal sampling ratio parameter, so as to obtain an optimized category dataset.

8. The apparatus according to claim 5, characterized in that, Also includes: The second generation unit is used to obtain feature information representing the attributes of each flow data obtained from a node from multiple fields of the flow data, and generate target flow data containing the feature information. The node is an interactive node between the private power grid and the public grid. The second classification unit is used to classify all the target traffic data using a clustering algorithm to obtain multiple category datasets, each category dataset containing multiple pieces of the target traffic data; The second optimization unit is used to sample and optimize the target traffic data in each category dataset using a genetic algorithm to obtain an optimized category dataset. The second calculation unit is used to calculate the correlation between the current feature information and the attack category for each feature information in the optimized category dataset using a mutual information feature selection algorithm, and to calculate the redundancy between the current feature information and the selected feature information. The attack categories include public network attack categories and power private network attack categories. The second determining unit is used to determine the mutual information feature selection value corresponding to the feature information based on the difference between the relevance and the redundancy. The second update unit is used to update the optimized category dataset according to the value selected based on the mutual information feature to obtain the sample dataset; The input unit is used to input the sample dataset into the attack detection classification model to obtain the sample detection results; The judgment unit is used to determine whether the sample detection result is the expected detection result; The third determining unit is used to determine the attack detection classification model as the trained attack detection classification model if the sample detection result is the expected detection result. An adjustment unit is used to adjust the parameters of the attack detection classification model if the sample detection result is not the expected detection result, and then return to execute the input unit.

Images