Physical-dynamic graph network based power grid attack detection explainability method

Abstract

The application discloses a power grid attack detection explainability method based on a physical-dynamic graph network, and comprises the following steps: acquiring network interaction behavior data in a power grid, modeling in a dynamic graph manner based on the network interaction behavior data, extracting nodes and edges at each moment from the network interaction behavior data, and constructing a dynamic graph; inputting the dynamic graph as input data into a pre-constructed attack detection module to obtain an attack detection result; inputting the attack determination result into a pre-constructed result explanation module to obtain a node subset with the highest abnormal contribution degree to attack node determination; and restoring an attack path according to the node subset to verify the attack detection explainability method. The technical scheme of the application can overcome the defect that the attack detection result of a traditional deep learning method lacks explainability, and improve the safety and reliability of engineering landing implementation.

Description

TECHNICAL FIELD

[0001] The present application relates to power system network security technology, in particular to a power grid attack detection explainability method based on a physical-dynamic graph network. BACKGROUND

[0002] The power system is one of the indispensable infrastructures in modern society, and the power grid is the core part of the power system. With the development of smart grid and Internet of Things technologies, the complexity and scale of the power grid are increasing. At the same time, network attacks have threatened the security and stability of the power grid. Therefore, it is very important to develop an efficient and accurate power grid attack detection method.

[0003] At present, the mainstream power grid attack detection method is based on machine learning and deep learning monitoring means, such as decision tree, recurrent neural network, convolutional neural network, etc. However, these methods have black box characteristics, and security and operation personnel cannot understand the basis for the model to make attack detection judgments, which reduces the reliability of engineering implementation. SUMMARY

[0004] The purpose of the present application is to provide a power grid attack detection explainability method based on a physical-dynamic graph network, which can overcome the defect of lack of explanation of the attack detection result of the traditional deep learning method, and improve the safety and reliability of engineering implementation.

[0005] The power grid attack detection explainability method based on a physical-dynamic graph network of the present application comprises: obtaining network interaction behavior data in the power grid, modeling based on the network interaction behavior data in a dynamic graph manner, extracting nodes and edges at each time from the network interaction behavior data, and constructing a dynamic graph; inputting the dynamic graph as input data into a pre-constructed attack detection module to obtain an attack detection result; inputting the attack judgment result into a pre-constructed result explanation module to obtain a node subset with the highest abnormal contribution degree to the attack node judgment; and restoring the attack path according to the node subset to verify the attack detection explainability method.

[0006] Further, the network interaction behavior data in the power grid is obtained, the network behavior interaction data is modeled in a dynamic graph manner, the nodes and edges at each time are extracted from the network behavior interaction data, and a dynamic graph is constructed, comprising: obtaining network interaction behavior data in the power grid, taking users, hosts, files, and websites in the network interaction behavior data as nodes, and the connection relationship between nodes as edges, establishing a dynamic sequence S, S={e1, e2,..., en}, where en represents the edge interaction information at time n; each edge interaction information en represents the edge interaction information at time n; each edge interaction information en is composed of a source node, a target node, and an edge type; the source node of each edge interaction information en is denoted as V i ,...} where en represents the edge interaction information at time n; each edge interaction information en is composed of a source node, a target node, and an edge type; the source node of each edge interaction information en is denoted as V i wherein, denotes the source node at time i, ​denotes the destination node at time i, t i denotes the timestamp at time i, attr i denotes the edge interaction feature at time i; all edge interaction information constitutes a dynamic graph G=(N, S), wherein N denotes all nodes involved in S.

[0007] Further, the dynamic graph is input as input data into a pre-constructed attack detection module to obtain an attack detection result, including: the attack detection module is a dynamic graph neural network model constructed by using an encoder-decoder architecture; G i denotes the dynamic graph at time i, including a dynamic sequence S={e1,..., en}, wherein n denotes the number of nodes in the dynamic graph G i-1 . i The dynamic graph G i is input into a dynamic graph neural network model to obtain an embedding representation Z i of the dynamic graph. i n denotes the current embedding of node n at time t i ; the encoder learns the dynamic embedding of each node over time, and the decoder uses Z i to calculate a loss in the training phase to backpropagate gradients and update model parameters, and uses Z i to predict the probability of a new event between any pair of nodes being an attack in the detection phase to obtain an attack detection result.

[0008] Further, the decoder uses Z i to calculate a loss in the training phase to backpropagate gradients and update model parameters, including: the physical constraint formula is added as a loss function, so that the dynamic graph neural network model is not only constrained by the original loss function when updating parameters in the backpropagation, but also needs to satisfy the physical constraint formula; the difference between before and after iteration of the physical constraint formula is added to the loss function of the dynamic graph neural network model, and the physical equation participates in the training process.

[0009] Further, the physical constraint formula is three-sigma, including: the loss function of the physical constraint is wherein σ denotes the standard deviation of the feature attr i , and μ denotes the mean of the feature attr i .

[0010] Further, the attack determination result is input into a pre-constructed result interpretation module to obtain a node subset with the highest abnormal contribution degree to the attack node determination, including: the result interpretation module adopts an explorer-navigator architecture, the encoder of the attack detection module is introduced when training the navigator to learn an important event subset R k of the target event e k , the explorer is guided by the navigator, and according to a Monte Carlo tree search algorithm, the explorer searches the subset R in the subset R according to the Monte Carlo tree search algorithm, and the explorer searches the subset R according to the Monte Carlo tree search algorithm.k The node subset with the highest abnormal contribution degree to the attack node determination is obtained.

[0011] Further, the attack determination result is input into a pre-constructed result interpretation module to obtain the node subset with the highest abnormal contribution degree to the attack node determination, including: constructing a navigator input feature:

[0012]

[0013] Wherein, X represents a node feature matrix; Time(·) is a time function for converting a real-valued timestamp into a time vector; h(·) inputs all candidate events relative to the target event as a batch.

[0014] Further, the attack determination result is input into a pre-constructed result interpretation module to obtain the node subset with the highest abnormal contribution degree to the attack node determination, including: the explorer initializes the root node as the set of candidate events; multiple rounds of expanding nodes in the search tree, wherein each node represents a feasible event subset in the search space; and the node that meets the sparsity threshold and obtains the best reward is taken as the final interpretation result of the result interpretation module, and the final interpretation result is taken as the node subset with the highest abnormal contribution degree to the attack node determination; wherein, multiple rounds of expanding nodes in the search tree, each round includes: initializing the explorer in the result interpretation module, selecting a path from the root node to the leaf node; using the initialized explorer to select a node, expanding a new child node according to the navigator deleting unimportant events in the path selection process; and expanding the explorer, stopping the expansion when the exploration reaches the leaf node, and propagating the reward of the leaf node in the path to update the information in the path node.

[0015] Further, the explorer in the result interpretation module is initialized, and a path is selected from the root node to the leaf node, including: the root node includes all candidate events, the explorer aggregates the event set obtained by the explorer using the second-order neighbor; a time threshold is used to remove old events, and only the most recently occurring events within the preset threshold are retained to initialize the root node information.

[0016] Further, the initialized explorer is used to select a node, and a new child node is expanded according to the navigator deleting unimportant events in the path selection process, including: using N i represents a node in the Monte Carlo search tree, and e j represents an action, and the action criterion is used to balance the development and exploration processes in node selection, assuming that the node N i is being selected, then the action criterion is

[0017]

[0018] Among them, C(N) i ) indicates that it is already at node N i Extended events in n(N); i ,e j ) indicates that node N was selected in the previous round. i e j The count; c(N) i ,e j ) indicates selecting node N i e j The cumulative reward; during development, select nodes with high average rewards; during exploration, select to simulate a small number of nodes; through N i Delete event e to select and move to N i The child nodes.

[0019] Furthermore, the explorer undergoes node diffusion, backpropagating the rewards of leaf nodes to update information in path nodes, including: expanding the best potential nodes to improve the search space and the quality of the best nodes, for node N. i The explorer calls the navigator to obtain potential scores.

[0020]

[0021] Where, N i / C(N i ) represents a possible event that was not expanded in the previous simulation; the least important event e* is removed to expand the new node; the first k candidates are expanded, introducing randomness to balance development and exploration in the expansion step.

[0022] Beneficial Effects: Compared with the prior art, the technical solution of this invention has the following beneficial effects: Based on dynamic graph data preprocessing, nodes and edges at each moment are extracted from network interaction behavior data; the dynamic graph data is input into a dynamic graph neural network based on physical constraints to obtain detection results; the detection results are input into an interpreter based on the Monte Carlo search tree algorithm to obtain an interpretation of the attack detection results; the dynamic graph network detector-interpreter framework based on physical constraints designed in this invention is beneficial for network security personnel to understand the process and mechanism of attacks, and makes the factual interpretation of power grid attack detection results more understandable and acceptable. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the process of the present invention;

[0024] Figure 2 This diagram illustrates the initialization of the module explorer node. Detailed Implementation

[0025] The technical solution of the present invention will now be described in detail with reference to specific embodiments and accompanying drawings.

[0026] like Figure 1 As shown, the interpretability method for power grid attack detection based on physical-dynamic graph networks of the present invention includes the following steps:

[0027] S1. Obtain network interaction behavior data in the power grid, and model the network interaction behavior data in a dynamic graph manner. Extract the nodes and edges at each time point from the network interaction behavior data to construct the dynamic graph.

[0028] Acquire network interaction behavior data in the power grid, and establish a dynamic sequence S using users, hosts, files, and websites in the network interaction behavior data as nodes and the connections between nodes as edges.

[0029] S = {e1, e2, ...}, where e i Represents the edge interaction information at time i; interaction information of each edge. in, Represents the source node at time i. Let t represent the destination node at time i. i Attr represents the timestamp at time i. i Let i represent the edge interaction characteristics at time i; all edge interaction information constitutes a dynamic graph G = (N, S), where N represents all nodes involved in S.

[0030] S2. Input the dynamic graph as input data into the pre-built attack detection module to obtain the attack detection results.

[0031] The attack detection module is a dynamic graph neural network model built using an encoder-decoder architecture. It takes a dynamic graph G as input and outputs attack detection results. First, the encoder learns the dynamic embedding of each node over time; second, the decoder uses the node embeddings to perform the attack detection task. Specifically, it includes the following:

[0032] Let G i This represents the dynamic graph at time i, containing the dynamic sequence S = {e1, ..., e}. i-1}, G i Input a dynamic graph neural network model to obtain the embedding representation Z of the dynamic graph. i Among them, G i It contains n nodes, Z i n Indicates t i The current embedding of time node n;

[0033] The encoder learns the dynamic embedding of each node over time. The decoder constructs its loss by predicting the interactions between node pairs at that time. Therefore, the decoder uses Z during the training phase.i to calculate the loss to backpropagate the gradient and update the model parameters, and Z i predict the probability of new events between any pair of nodes as attacks, obtaining the attack detection results.

[0034] The physical constraint formula is added to the loss function, so that the dynamic graph neural network model is not only constrained by the original loss function when updating the parameters in the backpropagation, but also needs to meet the physical constraint formula; the difference between the iteration before and after the physical constraint formula is added to the loss function of the dynamic graph neural network model, and the physical constraint formula participates in the training process. The dynamic graph neural network not only optimizes the loss function of the network itself during training iteration, but also has the difference of the physical equation every iteration, so that the model training result meets the physical law.

[0035] The physical constraint formula is three sigma. The principle of three sigma is that the probability of numerical distribution in (μ-3σ, μ+3σ) is 0.9973. Therefore, the loss function of the physical constraint is where σ represents the standard deviation of the feature attr i , and μ represents the mean value of the feature attr i .

[0036] S3, input the attack judgment result into the pre-constructed result interpretation module to obtain the node subset with the highest abnormal contribution degree to the attack node judgment.

[0037] The result interpretation module adopts the explorer-navigator architecture. When training the navigator, the encoder of the attack detection module is introduced to learn the important event subset R k of the target event e k , the explorer is guided by the navigator, and the node subset with the highest abnormal contribution degree to the attack node judgment is obtained in the subset R k according to the Monte Carlo tree search algorithm.

[0038] The navigator in the pre-trained result interpretation module provides an overall understanding of the relationship between events. Specifically, the navigator is a feedforward neural network h(e j , e k ), which infers the importance score of an event e j relative to the target event e k . These scores will be used in the node expansion of the explorer to facilitate the search. The input features and the training / inference process are described as follows.

[0039] In order to capture the correlation between the target event e and each candidate event e , the navigator input features are constructed as follows:

[0040]

[0041] where X denotes the node feature matrix; Time(·) is a time function that converts real-valued timestamps into time vectors. All candidate events relative to the target event are input into h(·) as a batch.

[0042] The explorer of the result explanation module adopts the Monte Carlo tree search algorithm. First, the root node is initialized as the set of candidate events. Then, the nodes in the search tree are expanded in multiple rounds, where each node represents a feasible subset of events in the search space. Finally, the node that meets the sparsity threshold and obtains the best reward is taken as the final explanation result of the result explanation module, which is output by the model. The security and operation personnel can understand the node subset with the highest abnormal contribution to the attack node determined, and the attack path can be traced through the subset. The black box characteristics of the previous attack detection method based on deep learning are overcome, and the explainability and security and reliability of model detection are improved.

[0043] where the nodes in the multiple rounds of expanding the search tree each contain three aspects:

[0044] (1) The explorer in the result explanation module is initialized, and the path from the root node to the leaf node is selected;

[0045] The explorer in the result explanation module needs to be initialized, and the root node includes all candidate events that meet the requirements of space and time conditions. As shown in Figure 2 , it is assumed that the explorer takes the e1 event as the root, and uses the second-order neighbor for aggregation. The event set obtained by the explorer is {e2, ···, e7}. The time threshold is used to remove old events. If the threshold is set to 5, the 5 most recently occurring events are retained. Finally, the root node information is initialized according to {e3, ···, e7}. The nodes are connected to each other, and the directly connected nodes are called first-order neighbors, and if they are connected through another node, they are called second-order neighbors

[0046] (2) The initialized explorer is used for node selection, and new child nodes are expanded by deleting unimportant events in the path selection process according to the navigator;

[0047] The explorer in the result explanation module needs to select nodes, and uses N i to represent the nodes in the Monte Carlo search tree, and uses e j to represent an action. The action criterion according to formula (2) balances the development and exploration processes in node selection. It is assumed that we are on the node N i , and the action criterion is

[0048]

[0049] where C(N i ) represents the nodes that have been selected in the node Ni Extended events, n(N) i ,e j ) is the node N selected in the previous round. i e j The count, and c(N) i ,e j ) indicates selecting node N i e j The cumulative reward. First, during development, select nodes with high average rewards. Second, during exploration, select a small number of nodes to simulate. By starting from N... i Delete event e to select and move to N i The child nodes.

[0050] (3) Expand the explorer nodes. Stop expanding when the exploration reaches a leaf node. Backpropagate the rewards of the leaf nodes in the path to update the information in the path nodes.

[0051] The explorer in the results interpretation module needs to perform node diffusion, improving the search space and the quality of the best node by expanding the best potential node, for node N. i The explorer calls the navigator to obtain potential scores.

[0052]

[0053] Where, N i / C(N i The ) represents a possible event that was not expanded in the previous simulation. The least important event e* is removed to expand the new node.

[0054] Because the interpreter learns in advance and quickly infers scores, randomness is introduced into expanding the top k candidates to balance development and exploration in the expansion step. For example, e* is selected for expansion with a probability of 1-ε, while an unexplored e is randomly selected with a probability of ε. j The selection and expansion of nodes are performed alternately. Starting from the root node, new child nodes are expanded for the root node according to formula (3). Then, the node with the highest value based on formula (2), the original and new child nodes from the root node, is selected and moved to it. Next, the expansion and selection from new nodes are repeated. The process ends when the current node is identified as a leaf node, that is, when the node contains fewer than five events, thus obtaining the subset of nodes with the highest relevance to the target node.

[0055] S4. Reconstruct the attack path based on the node subset to verify the interpretability of the attack detection method.

[0056] The node subset contains a node set with high contribution to the judgment of the node as an attack. Starting from the node, the nodes in the node set are sorted in reverse order according to time sequence, and finally an attack path of the attacker attacking the node is formed. The attack path restored through the node subset is compared with the attack path detected in the real system, and the same path is analyzed through expert experience, so as to verify the effectiveness of the attack detection explainability method.

Claims

1. A physical-dynamic graph network based grid attack detection explainability method, characterized in that, The method comprises the following steps: obtaining network interaction behavior data in the power grid, modeling the network interaction behavior data in a dynamic graph manner, extracting nodes and edges at each moment from the network interaction behavior data, and constructing a dynamic graph; inputting the dynamic graph as input data into a pre-constructed attack detection module to obtain an attack detection result; inputting the attack determination result into a pre-constructed result interpretation module to obtain a node subset with the highest abnormal contribution degree to the attack node determination; and restoring the attack path according to the node subset to verify the attack detection explainability method.

2. The physical-dynamic graph network based grid attack detection explainability method of claim 1, wherein, The method comprises the following steps: obtaining network interaction behavior data in the power grid, modeling the network interaction behavior data in a dynamic graph manner, extracting nodes and edges at each moment from the network interaction behavior data, and constructing a dynamic graph, comprising: Se1, e2,..., e i ,..., where e i represents the edge interaction information at time i; each edge interaction information where, represents the source node at time i, represents the destination node at time i, t i represents the timestamp at time i, attr i represents the edge interaction feature at time i; all edge interaction information constitutes a dynamic graph G = (N, S), where N represents all involved nodes in S.

3. The physical-dynamic graph network based grid attack detection explainability method of claim 1, wherein, obtaining network interaction behavior data in the power grid, taking users, hosts, files, and websites in the network interaction behavior data as nodes, and taking the connection relationship between the nodes as edges to establish a dynamic sequence S, inputting the dynamic graph as input data into a pre-constructed attack detection module to obtain an attack detection result, comprising: Let G i denote a dynamic graph at time i, containing a dynamic sequence S{e1,...,e i-1}, and let G i be the input dynamic graph neural network model, resulting in an embedding representation Z i of the dynamic graph, where G i contains n nodes, and Z i n denotes the current embedding of node n at time t i . The encoder learns dynamic temporal embeddings for each node, and the decoder computes the loss using Z i to backpropagate the gradients and update the model parameters, and Z i to predict the probability of a new event between any pair of nodes as an attack, resulting in an attack detection result.

4. The physical-dynamic graph network based grid attack detection explainability method of claim 3, wherein, The decoder uses Z i to compute the loss to backpropagate the gradients and update the model parameters, including: the attack detection module is a dynamic graph neural network model constructed by using an encoder-decoder architecture; 5. The physical-dynamic graph network based grid attack detection explainability method of claim 4, wherein, the physical constraint formula is added to the loss function, so that the dynamic graph neural network model is not only constrained by the original loss function when updating the parameters in the back propagation, but also needs to meet the physical constraint formula; the difference between the iteration before and after the physical constraint formula is added to the loss function of the dynamic graph neural network model, and the physical constraint formula participates in the training process. The loss function of the physical constraint is where σ denotes the standard deviation of the feature attr i ; μ denotes the mean of the feature attr i .

6. The physical-dynamic graph network based grid attack detection explainability method of claim 1, wherein, The physical constraint formula is three sigma, comprising: The result interpretation module adopts an explorer-navigator architecture. When training the navigator, the encoder of the attack detection module is introduced to learn the important event subset R k of the target event e k . The explorer is guided by the navigator and obtains the subset of nodes with the highest abnormal contribution to the attack node in the subset R k according to the Monte Carlo tree search algorithm.

7. The physical-dynamic graph network based grid attack detection explainability method of claim 6, wherein, inputting the attack determination result into a pre-constructed result interpretation module to obtain a node subset with the highest abnormal contribution degree to the attack node determination, comprising: inputting the attack determination result into a pre-constructed result interpretation module to obtain a node subset with the highest abnormal contribution degree to the attack node determination, comprising: constructing a navigator input feature:

8. The physical-dynamic graph network based grid attack detection explainability method of claim 6, wherein, wherein X represents a node feature matrix; Time(·) is a time function for converting a real-valued timestamp into a time vector; all candidate events relative to a target event are input into the navigator as a batch. inputting the attack determination result into a pre-constructed result interpretation module to obtain a node subset with the highest abnormal contribution degree to the attack node determination, comprising: the explorer uses a Monte Carlo tree search algorithm to initialize the root node as a set of candidate events; expanding nodes in the search tree in multiple rounds, wherein each node represents a feasible event subset in the search space; and taking the node that meets the sparsity threshold and obtains the best reward as the final explanation result of the result interpretation module, and the final explanation result is the node subset with the highest abnormal contribution degree to the attack node determination; wherein the nodes in the search tree are expanded in multiple rounds, each round comprising: initializing the explorer in the result interpretation module, and selecting a path from the root node to a leaf node; using the initialized explorer to select nodes, and expanding new child nodes according to the events deleted by the navigator in the path selection process; and expanding the explorer, and stopping the expansion when the explorer reaches a leaf node, and propagating the reward of the leaf node in the path to update the information in the nodes in the path.

9. The physical-dynamic graph network based grid attack detection explainability method of claim 8, wherein, The explorer in the result interpretation module is initialized, a path is selected from the root node to the leaf node, including: The root node includes all candidate events The explorer uses the second-order neighbor to aggregate the event set obtained by the explorer; a time threshold is used to remove old events and retain the most recently occurring events equal to the preset threshold to initialize the root node information.

10. The physical-dynamic graph network based grid attack detection explainability method of claim 8, wherein, The initialized explorer is used for node selection, and the navigator is used to delete unimportant events in the path selection process to expand new child nodes, including: Using N i denotes a node in the Monte Carlo search tree, and using e j denotes a move; the action criterion balances exploitation and exploration processes in node selection according to the following formula, assuming that the move is being considered at node N i then the action criterion is where C(N i ) represents the events that have been expanded in the node N i ; n(N i , e j ) represents the count of selecting ej in the node Ni in the previous round; c(N i , e j ) represents the cumulative reward of selecting ej in the node Ni; in the development process, the node with high average reward is selected; in the exploration process, a small amount of nodes are simulated; by deleting events e from N i , the sub-node of N i is selected and moved to.

11. The physical-dynamic graph network based grid attack detection explainability method of claim 8, wherein, The explorer is expanded, and the expansion is stopped when the exploration reaches the leaf node; the reward of the leaf node in the path is reversely propagated to update the information in the path node, including: Extending the best potential node improves the search space and the quality of the best node, for node N i Explorer calls Navigator to get potential score where N i / C(N i ) denotes the possible events that were not expanded in the last simulation; the least important event e* is removed to expand a new node.

Images