An attribute graph-based power internet of things network anomaly detection method and system

Abstract

The application discloses a kind of attribute graph-based power internet of things network anomaly detection method and system, data preprocessing is carried out to input data X;Deep auto-encoder is trained, the feature embedding of X' after data preprocessing is extracted, and the data D' after dimension reduction is obtained;Based on the data D' after dimension reduction, according to the flow data in power internet of things, attribute graph G is constructed;According to attribute graph G, abnormal flow data is detected, and attribute graph-based power internet of things network anomaly detection is realized.The application uses deep auto-encoder to adaptively extract data features to realize feature dimension reduction without relying on labels, which reduces the time and space overhead of network anomaly detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of power Internet of Things, and particularly relates to a power Internet of Things network anomaly detection method and system based on an attribute graph. BACKGROUND

[0002] With the rapid development of computer and communication technologies, the power Internet of Things has become an inevitable trend of intelligent and information-based power grid construction. The power Internet of Things integrates cloud computing, Internet of Things, big data and other Internet technologies, and realizes real-time collection, transmission, storage and processing of power data through intelligent sensing of power data, high-quality communication networks and advanced data analysis, thereby improving the safety, reliability, economy and sustainability of the power grid. However, due to the open and interconnected nature of the power Internet of Things, it is more vulnerable to network attacks.

[0003] At present, most network anomaly detection methods for the power Internet of Things rely on data labels and artificial features. However, in real-world scenarios, there are three problems in network anomaly detection in the power Internet of Things scenario:

[0004] First, the data has the characteristics of high annotation cost and difficulty. If the method relies on labels, it is difficult to apply it to the actual system, and the detection ability for unknown attacks is weak.

[0005] Second, network attacks are sudden, and normal traffic data and abnormal traffic data are unevenly distributed. This characteristic may affect the effect of anomaly detection.

[0006] Third, artificial features are inaccurate, and the extracted features have a lot of redundancy, which may affect the detection efficiency of the model and waste storage space.

[0007] In order to solve the problem of network anomaly detection in the power Internet of Things, a reasonable scheme needs to be designed to reduce the dimensionality of the data without relying on labels, and to detect abnormal traffic data in the power Internet of Things when the data distribution is uneven. SUMMARY

[0008] The technical problem to be solved by the present application is to provide a power Internet of Things network anomaly detection method and system based on an attribute graph to solve the technical problems of high data labeling cost, redundant artificial features and low detection efficiency.

[0009] The application adopts the following technical solutions:

[0010] A power Internet of Things network anomaly detection method based on an attribute graph, comprising the following steps:

[0011] S1, data preprocessing is performed on input data X;

[0012] S2. Train the deep autoencoder and extract X from the data preprocessed in step S1. ′ Feature embedding is used to obtain the dimensionality-reduced data D. ′ ;

[0013] S3, Dimensionally reduced data D obtained from step S2 ′ Attribute graph G is constructed based on the flow data in the power Internet of Things;

[0014] S4. Detect abnormal traffic data based on the attribute graph G constructed in step S3, and realize the anomaly detection of the power Internet of Things network based on the attribute graph.

[0015] Specifically, step S1 is as follows:

[0016] Remove missing values ​​from the input data X; merge all input data X into one file; encode the categorical features using One-Hot encoding; then perform Z-Score standardization on the input data X to obtain the standardized input data X. ′ .

[0017] Specifically, step S2 is as follows:

[0018] S201. Initialize the depth autoencoder;

[0019] S202, Input data X ′ Input into the DAE model;

[0020] S203. Use the mean squared error as the loss function to calculate the reconstruction error;

[0021] S204. Use the Adam optimizer to optimize the encoder and decoder network parameters in the deep autoencoder based on the MSE.

[0022] S205. After reaching the set number of training iterations, output the trained deep autoencoder model.

[0023] S206. Input the data D that needs to be detected for anomalies into the depth autoencoder;

[0024] S207. After passing through the encoder, obtain the dimensionality-reduced data D. ′ .

[0025] Furthermore, in step S201, the learning rate is 0.001, the number of training iterations is 300, and the optimizer is the Adam optimizer.

[0026] Specifically, step S3 is as follows:

[0027] S301. Traverse the dataset D′, calculate the Euclidean distance as the similarity, and obtain the similarity matrix S;

[0028] S302, selecting k vertices with the highest similarity degree of each traffic data sample according to the similarity matrix S to establish an edge, and the weight of the edge is An adjacency matrix A is constructed.

[0029] S303, constructing an attribute graph G according to the adjacency matrix A and the data set D';

[0030] S304, calculating a degree matrix D according to the adjacency matrix A.

[0031] S305, calculating a Laplacian matrix L according to the adjacency matrix A and the degree matrix D.

[0032] Further, in step S302, the adjacency matrix A is:

[0033]

[0034] Wherein, A ij is the i-th row and j-th column of the similarity matrix A, S ij is the i-th row and j-th column of the similarity matrix S.

[0035] Further, in step S304, the matrix D is as follows:

[0036] D = diag (d1, d2, …, d N ) ∈ R N×N

[0037]

[0038] Wherein, d i is the degree of the i-th vertex in G, v j is the i-th vertex in the neighbor vertex of the vertex G, a ij is the weight of the i-th row and j-th column of the adjacency matrix A, R is a real number, and N is the number of vertices in G.

[0039] Specifically, step S4 is specifically:

[0040] S401, using the reduced data D' as the initial graph signal, using the heat equation to represent the energy propagation process of the attribute graph G, and using the heat kernel as a filter for smoothing processing;

[0041] S402, for any vertex u ∈ V, calculating the concentration under the parameter t;

[0042] S403, when the concentration c u (t) ≥ threshold value C, the vertex u is abnormal.

[0043] Further, in step S403, the threshold value C is:

[0044]

[0045] wherein, is the average value of the concentration of all vertices, and s(c(t)) is the standard deviation of the concentration of all vertices.

[0046] In a second aspect, the embodiments of the present application provide an attribute graph-based power Internet of Things network anomaly detection system, comprising:

[0047] a data module, which performs data preprocessing on input data X;

[0048] a training module, which trains a deep autoencoder, extracts feature embedding of the data preprocessed by the data module X', and obtains dimension-reduced data D';

[0049] a construction module, which constructs an attribute graph G based on the dimension-reduced data D' obtained by the training module according to traffic data in the power Internet of Things;

[0050] a detection module, which detects abnormal traffic data according to the attribute graph G constructed by the construction module, and realizes attribute graph-based power Internet of Things network anomaly detection.

[0051] Compared with the prior art, the present application has at least the following beneficial effects:

[0052] An attribute graph-based power Internet of Things network anomaly detection method, by means of unsupervised learning, realizes anomaly detection on unbalanced network traffic data without relying on data labels. Among them, adaptive feature extraction and feature dimension reduction are performed based on a deep autoencoder, which improves the anomaly detection efficiency while reducing the model cost; anomaly detection is performed based on an attribute graph, which solves the problem of low detection accuracy caused by unbalanced network traffic.

[0053] Further, the input data X is preprocessed, the data is processed into a format suitable for model processing by deleting invalid data, unifying data dimension, etc., and the accuracy and efficiency of the model are improved.

[0054] Further, the deep autoencoder model is trained, the high-dimensional input data is dimension-reduced while adaptive feature extraction is performed on the input data, and the detection efficiency of the model is improved and the time and space overhead is reduced.

[0055] Further, the processed data is modeled, the network traffic data is abstracted into an attribute graph G based on KNN and Euclidean distance, and the model assists in anomaly detection in the context of unbalanced data.

[0056] Further, based on graph signal processing, the attribute graph G is taken as an initial graph signal, a heat kernel is used to smooth the graph signal, and the concentration of each graph vertex is calculated. Then, a threshold is determined according to a Gaussian distribution, the graph anomaly detection is completed in a label-independent background, and abnormal traffic is screened out.

[0057] It can be understood that the beneficial effects of the second aspect described above can be referred to the related description in the first aspect described above, and will not be repeated here.

[0058] In summary, the application uses a deep autoencoder to adaptively extract data features to realize feature dimension reduction without relying on labels, thereby reducing the time and space overheads of network anomaly detection.

[0059] The technical solutions of the application will be further described in detail below with reference to the drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 The method architecture of the application is shown in the figure;

[0061] Figure 2 The data preprocessing flowchart of the application is shown in the figure;

[0062] Figure 3 The deep autoencoder training flowchart of the application is shown in the figure;

[0063] Figure 4 The deep autoencoder model structure of the application is shown in the figure;

[0064] Figure 5 The influence of whether the deep autoencoder is used on the results of anomaly detection of the application is shown in the figure;

[0065] Figure 6 The experimental results of the application under different proportions of abnormal samples are shown in the figure;

[0066] Figure 7 The block diagram of a chip provided by an embodiment of the application is shown in the figure. DETAILED DESCRIPTION

[0067] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are part of, but not all of the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the application.

[0068] In the description of the application, it should be understood that the terms "include" and "contain" indicate the presence of described features, whole, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, whole, steps, operations, elements, components and / or sets thereof.

[0069] It should also be understood that the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in the specification and the appended claims of the application, the singular forms "a", "an" and "the" are intended to include the plural forms, unless the context clearly indicates otherwise.

[0070] It should be further understood that the term "and / or" used in the specification and the appended claims of the application means one or more of the associated listed items in any combination and all possible combinations, and includes these combinations, for example, A and / or B can represent three cases: A exists alone, A and B exist together, and B exists alone. In addition, the character " / " in the application generally represents an "or" relationship between the front and rear associated objects.

[0071] It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the application to describe the preset ranges, etc., these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from each other. For example, the first preset range can also be referred to as the second preset range, and similarly, the second preset range can also be referred to as the first preset range, without departing from the scope of the embodiments of the application.

[0072] Depending on the context, the word "if" as used herein can be interpreted to mean "when" or "while" or "in response to determining" or "in response to detecting". Similarly, depending on the context, the phrase "if it is determined" or "if (a stated condition or event) is detected" can be interpreted to mean "when it is determined" or "in response to determining" or "when (a stated condition or event) is detected" or "in response to detecting (a stated condition or event)".

[0073] Various structural diagrams according to the disclosed embodiments of the application are shown in the drawings. These figures are not drawn to scale, in which certain details are exaggerated for the purpose of clarity and certain details can be omitted. The shapes of various regions, layers and their relative size and positional relationship shown in the figures are only exemplary, and in actuality, there can be deviations due to manufacturing tolerances or technical limitations, and a person skilled in the art can additionally design regions / layers with different shapes, sizes and relative positions according to actual needs.

[0074] The application provides a power internet of things network anomaly detection method based on an attribute graph, introduces a deep autoencoder, extracts abstract features of network traffic in the power internet of things, realizes feature dimension reduction in the background of unsupervised learning, improves the detection efficiency, introduces an attribute graph, completes anomaly detection under the condition of unbalanced traffic data distribution according to the attribute relationship and spatial relationship between the traffic data, and improves the detection accuracy.

[0075] Please refer to Figure 1 The application provides a power internet of things network anomaly detection method based on an attribute graph, including the following steps:

[0076] S1, data preprocessing is performed on input data X;

[0077] Please refer to Figure 2 The specific steps are as follows:

[0078] S101, for the part containing missing values in the input data, directly delete the data;

[0079] S102, the input data contains multiple files, and all data are combined into one file;

[0080] S103, using One-Hot encoding to encode the category features;

[0081] S104, Z-Score standardization is performed on the input data X to eliminate the dimensional difference between different features, and the standardized input data X' is obtained.

[0082] The input data X' is as follows:

[0083]

[0084] Wherein, X' is the result of Z-Score standardization, X is the input data, mu is the average value, and sigma is the standard deviation.

[0085] S2, training a deep autoencoder (Deep Autoencoder, DAE) to extract the feature embedding of X', and realizing feature dimension reduction;

[0086] Please refer to Figure 3 The specific steps are as follows:

[0087] S201, initializing the deep autoencoder, setting the learning rate (Learning Rage, LR) to 0.001, the training frequency to 300, and the optimizer to Adam optimizer;

[0088] S202, inputting the input data X' into the DAE model, and the model structure of the DAE is shown in Figure 4 ; and

[0089] S203, calculate the reconstruction error using Mean-Square Error (MSE) as the loss function;

[0090] The reconstruction error MSE is as follows:

[0091]

[0092] where n is the number of samples of the input data X', X' j is the i-th sample of the input, is the i-th sample reconstructed by the deep autoencoder.

[0093] S204, use the Adam optimizer to optimize the encoder and decoder network parameters in the deep autoencoder according to the MSE;

[0094] S205, output the trained deep autoencoder model after reaching the set number of training times;

[0095] S206, input the data D that needs to be detected into the deep autoencoder;

[0096] S207, pass through the encoder to obtain the reduced dimension data D'.

[0097] S3, construct an attribute graph G according to the flow data in the power Internet of Things;

[0098] S301, traverse the data set D', calculate the Euclidean distance as the similarity, and obtain the similarity matrix S;

[0099] The similarity matrix S is as follows:

[0100]

[0101] where S ij is the i-th row j-th column of the similarity matrix S, S ji is the j-th row i-th column of the similarity matrix S, D' i is the i-th sample of D', D' j is the j-th sample of D'.

[0102] S302, select the k vertices with the highest similarity for each flow data sample to establish edges, and the weight of the edge is to construct the adjacency matrix A;

[0103] The adjacency matrix A is as follows:

[0104]

[0105] where A ij is the i-th row j-th column of the similarity matrix A, Sij It is the i-th row and j-th column of the similarity matrix S.

[0106] S303. Construct the attribute graph G based on the adjacency matrix A and the dataset D′;

[0107] The attribute graph G is:

[0108] G = (V, E, D')

[0109] Wherein, V represents the set of vertices, and a vertex in V represents a traffic data sample in the proposed method; E represents the set of edges between vertices, and the presence of an edge between vertices indicates that the two vertices are similar, with the weight of the edge representing the similarity between the vertices; D′ is the feature matrix, representing the set of attributes of the vertices, which in this invention are abstract features extracted by the deep autoencoder.

[0110] S304. Calculate the degree matrix D based on the adjacency matrix A;

[0111] The degree matrix D is as follows:

[0112] D = diag(d1, d2, ..., d...) N )∈R N×N

[0113]

[0114] Where, d i Let v be the degree of the i-th vertex in G. j Let a be a neighboring vertex of the i-th vertex in vertex G. ij Let be the weight of the i-th row and j-th column of the adjacency matrix A.

[0115] S305. Calculate the Laplace matrix L based on the adjacency matrix A and the degree matrix D.

[0116] The Laplace matrix L is as follows:

[0117] L=DA

[0118] Where D is the degree matrix of graph G, and A is the adjacency matrix of graph G.

[0119] S4. Detect abnormal traffic data based on the constructed attribute graph G.

[0120] S401. The data D′ after dimensionality reduction by deep autoencoder is used as the initial graph signal. The energy propagation process of graph G is represented by the heat equation, in which the heat kernel is used as a filter for smoothing.

[0121] In fact, thermonuclear e -tL Its function is to denoise the graph signal under parameter t. For any node u∈V, x u(t) is used to represent the internal energy of a node, the greater it is, the more unsmooth the vertex is, that is, the greater the difference with the neighbor nodes.

[0122] The heat equation of the graph G is formulated as follows:

[0123]

[0124] Where L is the Laplacian matrix of the graph G, t is the time of heat propagation, x(0) is the initial graph signal D'

[0125] S402, for any vertex u∈V, calculate the concentration under the parameter t;

[0126] Since the heat kernel preserves the sum or average of the graph signal, the concentration is an expression that can effectively extract the node signal features; the maximum value of the signal filtered by the heat kernel is 1, and for a signal whose sum is 1 distributed on N vertices, the minimum value is 1 / N when the signal is completely smooth.

[0127] If the concentration of a vertex under the parameter t is greater, it means that the correlation between the vertex and its neighbor vertices is lower; therefore, the greater the concentration of a vertex, the greater the possibility that it is an outlier vertex.

[0128] The concentration is defined as follows:

[0129] c u (t)=||e -tL δ u ||2

[0130] Where c u (t) represents the signal obtained after filtering the vertex u∈V under the parameter t, L is the Laplacian matrix, and δ u is the impact function, which represents a unit value at vertex u, otherwise 0.

[0131] S403, in order to screen out outlier vertices, a threshold C is needed to determine the anomaly, when the concentration of a certain vertex is greater than the threshold, it means that the vertex is abnormal; that is, for any vertex u∈V, when its concentration c u (t)≥C, the vertex u is considered abnormal.

[0132] Find the concentration c(t) of each vertex in the attribute graph;

[0133] The concentration c(t) of each vertex in the attribute graph is:

[0134] c(t)=[c1(t),c2(t),...,c N (t)]

[0135] The size of the threshold depends on the average concentration and the standard deviation of all vertices, which are defined as follows:

[0136]

[0137] wherein, is the average value of the concentration of all vertices, and s(c(t)) is the standard deviation of the concentration of all vertices.

[0138] In another embodiment of the present application, a property graph-based power Internet of Things network anomaly detection system is provided, which can be used to implement the property graph-based power Internet of Things network anomaly detection method described above. Specifically, the property graph-based power Internet of Things network anomaly detection system includes a data module, a training module, a construction module, and a detection module.

[0139] The data module performs data preprocessing on the input data X.

[0140] The training module trains a deep autoencoder to extract the feature embedding of the data X' preprocessed by the data module, and obtains the reduced dimension data D'.

[0141] The construction module constructs a property graph G based on the reduced dimension data D' obtained by the training module according to the flow data in the power Internet of Things.

[0142] The detection module detects abnormal flow data according to the property graph G constructed by the construction module, and realizes property graph-based power Internet of Things network anomaly detection.

[0143] In another embodiment of the present application, a terminal device is provided, which includes a processor and a memory. The memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions to realize the corresponding method process or corresponding function. The processor described in the embodiments of the present application can be used for the operation of the property graph-based power Internet of Things network anomaly detection method, which includes:

[0144] data preprocessing on the input data X; training a deep autoencoder, extracting feature embedding of the data X after data preprocessing, obtaining data D after dimension reduction ′ ′ ; constructing an attribute graph G based on the data D after dimension reduction according to the flow data in the power internet of things; detecting abnormal flow data according to the attribute graph G, realizing attribute graph-based power internet of things network anomaly detection. ′

[0145] Please refer to Figure 7 , the terminal device is a chip, the chip 600 of the embodiment includes a processor 622, the number of which can be one or more, and a memory 632 for storing a computer program executable by the processor 622. The computer program stored in the memory 632 can include one or more modules each corresponding to a set of instructions. In addition, the processor 622 can be configured to execute the computer program to perform the attribute graph-based power internet of things network anomaly detection method described above.

[0146] In addition, the chip 600 can also include a power supply component 626 and a communication component 650, the power supply component 626 can be configured to perform power management of the chip 600, and the communication component 650 can be configured to realize communication of the chip 600, for example, wired or wireless communication. In addition, the chip 600 can also include an input / output (I / O) interface 658. The chip 600 can operate based on an operating system stored in the memory 632.

[0147] In another embodiment of the application, the application also provides a storage medium, specifically a computer readable storage medium (Memory), the computer readable storage medium is a memory device in a terminal device, used for storing programs and data. It can be understood that the computer readable storage medium here can include an internal storage medium in the terminal device, and of course can also include an expansion storage medium supported by the terminal device. The computer readable storage medium provides a storage space, and the storage space stores an operating system of the terminal. Moreover, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium here can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory.

[0148] ​​The one or more instructions in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the attribute graph based power internet of things network anomaly detection method in the above embodiments.

[0149] Data preprocessing is performed on input data X, a deep autoencoder is trained, feature embedding of X after data preprocessing is extracted, and reduced dimension data D ′ is obtained. ′ Based on the reduced dimension data D ′ , an attribute graph G is constructed according to the flow data in the power internet of things, and abnormal flow data is detected according to the attribute graph G, so as to realize the attribute graph based power internet of things network anomaly detection.

[0150] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0151] The effect of the present application will be further described below in combination with simulation experiments:

[0152] The method of the present application is tested on the standard data set NSL-KDD. Figure 5 The influence of feature embedding extracted by the deep autoencoder on the network anomaly detection performance is illustrated. After dimension reduction using the deep autoencoder, the result of anomaly detection based on the attribute graph (AG) is represented as DAE+AG, and the experimental result of directly using the attribute graph for anomaly detection is represented as AG. The detection effect of the proposed method under different data distributions is simulated by comparing the experimental results under the conditions of abnormal sample proportions of 35% and 15% respectively. In order to more comprehensively evaluate the performance of the proposed method under unbalanced data, Figure 6 The experimental results of the method of the present application under different proportions of abnormal samples are illustrated by ROC curve and AUC value to illustrate its effectiveness.

[0153] From Figure 5It can be seen that compared with directly using the attribute graph for anomaly detection, the performance slightly decreases after using the deep auto-encoder to reduce the traffic data features from 41 dimensions to 20 dimensions.

[0154] Specifically, when the proportion of abnormal samples is 35%, the precision, recall and precision of the three indicators decrease by an average of 1%; when the proportion of abnormal samples is 15%, the three indicators decrease by an average of about 1%. Therefore, according to the experimental results on the two data sets, the deep auto-encoder can reduce the dimensionality of the traffic data, improve the detection efficiency, and at the same time will not have too much influence on the detection results.

[0155] From Figure 6 It can be seen that according to the ROC curve of the method of the present application under different proportions of abnormal samples, as the proportion of abnormal samples decreases, the area of the ROC curve is larger, that is, the value of AUC gradually increases, and the detection performance of the method is better and better. When the proportion of abnormal samples is 5%, the AUC of DAEAG reaches the maximum value of 0.976; when the proportion of abnormal samples is 45%, the AUC value decreases to 0.89.

[0156] It can be seen from the experimental results that the detection performance of the method of the present application under unbalanced data is obviously higher than that under balanced data. Overall, compared with balanced data, the method performs better on unbalanced data, and the method is highly available.

[0157] The experimental results show that the method of the present application can effectively complete the network anomaly detection task in the power internet of things under the condition of not relying on labels and unbalanced data.

[0158] In summary, the power internet of things network anomaly detection method and system based on the attribute graph provided by the present application, the network traffic data has unbalanced characteristics, which causes challenges to network anomaly detection. The present application models the network traffic data in the power internet of things as an attribute graph, and considers the attribute relationship and spatial relationship between the traffic data for anomaly detection; the present application calculates the concentration of the graph vertex based on the attribute graph, and detects the abnormal network traffic data according to the threshold value, and has good detection ability for unbalanced data without relying on labels.

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is exemplified, and in actual application, the above-mentioned functions can be completed by different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be realized in the form of hardware or software. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction, and do not limit the protection scope of the present application. The specific working process of the units and modules in the above system can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0160] In the above embodiments, the description of each embodiment has its own emphasis, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0161] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0162] In the embodiments provided by the present application, it should be understood that the disclosed devices / terminals and methods can be implemented by other ways. For example, the device / terminal embodiments described above are only schematic, and the division of the modules or units is only a logical function division, and there can be another division way in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection between each displayed or discussed unit can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0163] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0164] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0165] The integrated module / unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on such understanding, the present application realizes all or part of the processes in the above-mentioned embodiment methods, and can also be completed by instructing related hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can realize the steps of each method embodiment when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer-readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content included in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0166] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one flow or multiple flows and / or blocks Figure 1 The functions specified in one flow or multiple flows and / or blocks

[0167] These computer program instructions can also be stored in a computer-readable storage medium, which can guide the computer or other programmable data processing devices to work in a specific way, so that the instructions stored in the computer-readable storage medium produce a manufactured product including instruction devices, which realize the functions specified in the flowcharts and / or block diagrams. Figure 1one or more processes and / or blocks Figure 1 the function specified in the one or more blocks.

[0168] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable data processing devices to generate a computer-implemented process, so that the instructions executed on the computer or other programmable data processing devices provide a process for implementing the flowchart Figure 1 one or more processes and / or blocks Figure 1 the steps of the function specified in the one or more blocks.

[0169] The above is only to illustrate the technical idea of the present application, and cannot limit the protection scope of the present application. Any modification made according to the technical idea of the present application on the basis of the technical scheme falls within the protection scope of the claims of the present application.

Claims

1. An attribute graph-based power internet of things network anomaly detection method, characterized in that, The method comprises the following steps: S1, pre-processing the input data performing data pre-processing; S2, training a deep autoencoder to extract feature embeddings of the data pre-processed in step S1, obtaining reduced dimension data ;​ S3、based on the data after dimension reduction obtained in step S2 , constructing an attribute graph according to flow data in a power internet of things ; S4. Constructing the attribute graph according to step S3 Detecting abnormal flow data and realizing attribute graph-based power Internet of Things network anomaly detection, specifically: S401、reducing dimensionality of the data As an initial graph signal, a heat equation is used to represent the attribute graph The energy propagation process of the heat kernel is used as a filter to smooth the signal S402、For any one vertex , calculate the concentration under the parameters of S403, when concentration At that time, the vertex This is abnormal, threshold. for: wherein, is the average of the concentration of all vertices in the set, is the standard deviation of the concentration of all vertices in the set.

2. The attribute graph-based power internet of things network anomaly detection method according to claim 1, characterized in that, Step S1 is specifically: Delete input data Parts containing missing values; all input data Merge into one file; encode categorical features using One-Hot encoding; then Z-Score standardize the input data X to get standardized input data . 3.The attribute graph based power internet of things network anomaly detection method according to claim 1, characterized in that, Step S2 is specifically: S201, initializing a deep autoencoder; S202, input data to the DAE model; S203, using mean square error as a loss function to calculate reconstruction error; S204, using an Adam optimizer to optimize the encoder and decoder network parameters in the deep autoencoder according to the MSE; S205, after reaching the set number of training times, outputting the trained deep autoencoder model; S206, data requiring anomaly detection input deep autoencoder; S207. After passing through the encoder, obtain the dimensionality-reduced data. .

4. The attribute graph-based power internet of things network anomaly detection method according to claim 3, characterized in that, In step S201, the learning rate is 0.001, the number of training times is 300, and the optimizer is an Adam optimizer.

5. The attribute graph-based power internet of things network anomaly detection method according to claim 1, characterized in that, Step S3 is specifically: S301、Traverse the dataset , calculate the Euclidean distance as similarity, get the similarity matrix ; S302、According to the similarity matrix , select the highest similarity of each traffic data sample The edge is established, and the weight of the edge is , the adjacency matrix is constructed ; S303、According to the adjacency matrix A and the data set , the attribute graph is constructed ; S304、according to the adjacency matrix , the degree matrix is calculated S305、according to the adjacency matrix and the degree matrix the Laplacian matrix is calculated .

6. The attribute graph-based power internet of things network anomaly detection method according to claim 5, characterized in that, In step S302, the adjacency matrix is: wherein is the similarity matrix of the first row column, is the similarity matrix of the second row column.

7. The attribute graph-based power internet of things network anomaly detection method according to claim 5, characterized in that, In step S304, the matrix is as follows: wherein, is the degree of the th vertex in V, is the neighbor vertex of the th vertex in V, is the adjacency matrix the weight of the th row th column, is a real number, is the number of vertices in V.​ 8. An attribute graph-based power internet of things network anomaly detection system, characterized in that, It comprises: data module, pre-processes input data ; A training module trains a deep autoencoder to extract feature embeddings from pre-processed data of a data module to obtain reduced dimension data ; A construction module, based on the reduced dimension data obtained by the training module , construct an attribute graph according to the traffic data in the power internet of things ; a detection module for detecting abnormal traffic data based on the attribute graph constructed by the construction module The application relates to an attribute graph-based power internet of things network anomaly detection method. reduced dimensionality data As an initial graph signal, a heat equation is used to represent the attribute graph The energy propagation process of the heat kernel is used to smooth the signal; For any one vertex , the concentration under the parameters is calculated; When the concentration , the vertex is abnormal, the threshold is: wherein, is the average of the concentration of all vertices, is the standard deviation of the concentration of all vertices.

Images