An intelligent identification method of network attack situation based on power monitoring system

Abstract

The present invention relates to the technical field of network data security monitoring, and in particular to a network attack situation intelligent identification method based on an electric power monitoring system. A malicious code analysis module analyzes the code stored in a malicious code library to classify the malicious code stored in the malicious code library into families and study the relationship between malicious codes of the same family. An interactive data analysis module compares the data to be interacted with the stored malicious code to determine the security of the interactive data. The present invention processes the data to be interacted into images and compares the extracted features with preset malicious features to determine whether it is an existing malicious code family. For those that do not belong to the existing malicious code family, the features are determined to determine whether the data to be interacted belongs to a new malicious feature family. The present application can discover new malicious codes and ensure the stability of the operation of the power system.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security monitoring, and in particular to a network attack situation intelligent identification method based on an electric power monitoring system. Background Art

[0002] At present, malicious code detection can be divided into artificial intelligence-based malicious code detection technology, machine learning-based malicious code detection technology, deep learning-based malicious code visualization detection technology, etc. The research level review at home and abroad includes: (1) Artificial intelligence-based malicious code detection technology. It can be roughly divided into two categories: heuristic detection method and feature-based detection method. Malicious code obfuscation technology can be divided into two categories according to its implementation principle: interference anti-reversing (disassembly) obfuscation and instruction and control flow obfuscation. The method of converting original binary code into visual files such as text, images, and audio is already very mature. Therefore, the method of converting malicious code into visual images, extracting statistical features from them and classifying them is feasible in principle. The binary executable files of malicious code are visualized as grayscale images and compared. It is found that the structure and layout of the grayscale images of malicious code of the same family are very similar. On this basis, the genetic features of the grayscale images of malicious code are extracted and the malicious code is classified according to these features. Artificial intelligence malicious code graph detection technology combines deep learning technology, image texture analysis technology and malicious code variant detection technology to overcome the limitations of traditional security mechanisms, efficiently and accurately detect malicious code variants, and effectively fight against malicious code variants, becoming an effective means to fight against malicious code variant attacks and APT attacks. (2) Malicious code detection methods based on machine learning. In recent years, a large number of studies and surveys have found that machine learning algorithms are very effective for detecting malicious code. Nataraj et al. first converted malware into grayscale images, and subsequent research on malicious code images was carried out on this basis. It is an important breakthrough in the combination of security analysis and machine learning algorithms. In addition, some other algorithms are also used for malicious code detection. Ko lter et al. used machine learning and data mining to detect malware executable files. This method evaluated and compared several algorithms including Bayes, decision tree and support vector machine, and found that the improved decision tree algorithm was the most effective. (3) Malicious code visualization detection and classification method based on deep learning. It is mainly divided into two types: a malicious code analysis method based on the N-grammatical features of byte sequences, which takes the characteristics of bytes themselves as visualization objects; a malicious code analysis method based on local entropy, which takes the information reflected by bytes as visualization objects; and a malicious code analysis method based on the frequency of operation codes, which takes the semantics of bytes as visualization objects.

[0003] The power grid is an important network facility related to the development and construction of people's livelihood. With the development of the network, the means of attacking the power grid have become increasingly complicated. The existing technology often only records and compares malicious attacks according to existing malicious data, and is unable to discover new malicious data, resulting in poor protection of the power grid. Summary of the invention

[0004] To this end, the present invention provides a method for intelligently identifying network attack situations based on an electric power monitoring system, so as to overcome the problem in the prior art that new malicious data cannot be discovered and the protection effect of the electric power network is poor.

[0005] To achieve the above-mentioned purpose, the present invention provides a method for intelligently identifying network attack situations based on a power monitoring system, comprising:

[0006] The malicious code analysis module converts the malicious code stored in the malicious code library into grayscale images and performs convolution operations on the grayscale images to generate different levels;

[0007] The malicious code analysis module extracts and analyzes features of each of the layers to obtain malicious features of each malicious code, and classifies each malicious code into families according to malicious feature relationships to determine relationships between malicious codes of the same family;

[0008] The interactive data analysis module characterizes the data to be identified after being identified by the interactive data identification module, and compares its characteristics with the malicious characteristics to find similar codes at different levels of the data to be identified;

[0009] Analyze similar codes at different levels to determine whether the data to be identified is malicious data, and determine the malicious code relationship of the data to be identified after it is determined to be malicious data.

[0010] Furthermore, the malicious code library numbers the malicious codes stored therein;

[0011] For any malicious code, the malicious code analysis module maps it to form a grayscale image corresponding to it, and extracts features from the grayscale image to generate a set of structural features of a single malicious code in the grayscale image;

[0012] The malicious code library performs convolution operation on the acquired grayscale image to obtain data feature sets of the malicious code in the convolution layer, the pooling layer, the fully connected layer and the output layer respectively;

[0013] The malicious code analysis module compares and analyzes the features of the malicious codes in each layer, determines the malicious features of each layer, and compiles and generates a malicious feature set.

[0014] Furthermore, the malicious code analysis module compares the features of different malicious codes in the grayscale image in pairs, and determines whether the compared features are malicious features by comparing the repetition between the features.

[0015] Furthermore, the malicious code analysis module determines a feature relationship between features according to different degrees of repetition between features, and the feature relationship includes similar features, related features, and unrelated features.

[0016] Furthermore, the malicious code analysis module marks the features determined to be similar features as first-level malicious features of the grayscale image, and marks the features determined to be related features as second-level malicious features of the grayscale image;

[0017] If any feature is marked as a similar feature, a related feature, and an irrelevant feature respectively when compared with other different features, the malicious code analysis module marks it as a first-level malicious feature of the grayscale image;

[0018] If any feature is marked as a relevant feature and an irrelevant feature respectively when compared with other different features, the malicious code analysis module marks it as a second-level malicious feature of the grayscale image;

[0019] The malicious code analysis module integrates the determined first-level malicious features of the grayscale image and the second-level malicious features of the grayscale image to generate a first-level malicious feature set of the grayscale image and a second-level malicious feature set of the grayscale image.

[0020] Furthermore, the malicious code analysis module analyzes and compares the data features of the convolution layer, pooling layer, fully connected layer and output layer according to the feature comparison analysis method of the grayscale image, and obtains the first-level malicious feature set of the convolution layer, the second-level malicious feature set of the convolution layer, the first-level malicious feature set of the fully connected layer, the second-level malicious feature set of the fully connected layer, the first-level malicious feature set of the pooling layer, the second-level malicious feature set of the pooling layer, the first-level malicious feature set of the output layer, and the second-level malicious feature set of the output layer one by one.

[0021] Furthermore, the malicious code analysis module integrates and clusters the malicious features of the same layer to generate malicious feature clusters, and analyzes each malicious code to classify the malicious code into families.

[0022] Furthermore, for any two different malicious codes, the malicious code analysis module analyzes the number of similar features and related features between them, and determines the group relationship of the two malicious codes in the same layer of data.

[0023] Furthermore, the interactive data analysis module extracts codes from the data to be interacted with, and performs mapping processing on the extracted codes to generate a grayscale image to be identified, and the interactive data analysis module extracts features from the grayscale image to be identified and numbers it;

[0024] The interactive data analysis module compares all the features of the interactive data in the grayscale image with the malicious features of the grayscale image one by one. For any feature to be identified in the grayscale image, the interactive data analysis module compares it with the features of the first-level malicious feature set of the grayscale image and the second-level malicious feature set of the grayscale image one by one to obtain similar features;

[0025] The interactive data analysis module analyzes the features of all the interactive data in the grayscale image, and selects the malicious code with the highest matching degree with the similar features as the grayscale image similar code;

[0026] The interactive data analysis module determines similar codes of the data to be interacted in the convolutional layer, the pooling layer, the fully connected layer and the output layer one by one.

[0027] If the similar codes exist in the same malicious code relationship tree, the data to be interacted with is determined to be a branch of the relationship tree and is determined to be malicious data.

[0028] Furthermore, if the similar codes do not exist in the relationship tree of the same malicious code, the interactive data is analyzed again to determine whether it is malicious data.

[0029] Compared with the prior art, the beneficial effect of the present invention lies in that the present invention determines whether the data to be interacted belongs to an existing malicious code family by imaging the interactive data and comparing the extracted features with preset malicious features. For those that do not belong to the existing malicious code family, the features are judged to determine whether the data to be interacted belongs to a new malicious feature family. The present application can discover new malicious codes and ensure the stability of the power system operation.

[0030] Furthermore, the malicious code must contain a number of malicious features, and there is a certain correlation between malicious features of the same type. By comparing the features between malicious codes, the features with higher similarity in the malicious code are determined, and the similarity relationship between the features is determined based on the similarity. By obtaining similar features, the malicious features in the malicious code are found, laying the foundation for determining the data to be interacted with.

[0031] Furthermore, malicious features are graded by similarity to ensure the accuracy of malicious code identification. Different levels of data are judged one by one, and the malicious feature set of each level is determined respectively, enriching the samples of malicious features and making the analysis of interactive data more accurate.

[0032] Furthermore, by determining the number of similar features and related features between malicious codes, the correlation score of a malicious code to another malicious code is calculated, thereby determining the correlation between the codes, and considering the proportion of similar features and related features in the number of features of another malicious code when calculating the correlation score, to ensure the accuracy of the calculation results.

[0033] Furthermore, by comparing the relevance scores of a certain malicious code to another malicious code in a digital way, determining the relationship tree of the other malicious code, and integrating several relationship trees, generating a relationship map of malicious codes at the same level, and clarifying the relationship between malicious codes, it is ensured that when the maliciousness of the interactive data is determined, the correlation of the malicious features of the data to be interacted can be determined, laying the foundation for determining the category division of the data to be interacted or introducing new categories.

[0034] Furthermore, the relationship between data at different levels is determined one by one, and the malicious code relationship map of each level is determined respectively, so as to enrich the samples of the malicious code relationship map and make the analysis of the interactive data more accurate.

[0035] Furthermore, by characterizing the data to be identified and comparing its characteristics with the characteristics of each malicious code, similar codes at different levels of the data to be identified are found, and by analyzing similar codes at different levels, the security of the data to be identified is determined.

[0036] Furthermore, when similar codes of all levels exist in different hierarchical relationship trees of a malicious code, it means that the data to be identified has a very high degree of match with a malicious code. The data to be identified is determined to be a branch of the relationship tree and is determined to be malicious data, thereby ensuring the security of the power network.

[0037] Furthermore, for the data to be identified whose relationship tree cannot be determined, by integrating its similar feature matching degree with similar codes at each level, it is determined whether it is a new unidentified malicious code. If it is judged to be yes, the data to be interacted will be entered into the malicious code library, and its relationship tree and relationship graph will be determined to enrich the number of malicious codes, and new malicious codes will be identified and supplemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of a flow chart of a method for intelligently identifying network attack situations based on a power monitoring system in an embodiment;

[0039] Figure 2 It is a structural diagram of a network attack situation intelligent identification system based on a power monitoring system in an embodiment;

[0040] Figure 3 This is a flowchart of malicious feature determination in the embodiment;

[0041] Figure 4 A flow chart for determining the relationship between malicious codes in the embodiment;

[0042] Figure 5 4 is a flow chart of determining data to be identified in the embodiment. DETAILED DESCRIPTION

[0043] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0044] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0045] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0046] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0047] See also Figure 1-Figure 5 As shown, Figure 1 A schematic diagram of a flow chart of a method for intelligently identifying network attack situations based on a power monitoring system in an embodiment; Figure 2 It is a structural diagram of a network attack situation intelligent identification system based on a power monitoring system in an embodiment; Figure 3 This is a flowchart of malicious feature determination in the embodiment; Figure 4 A flow chart for determining the relationship between malicious codes in the embodiment; Figure 5 Flow chart of determining data to be identified in the embodiment

[0048] The present invention provides a network attack situation intelligent identification system based on a power monitoring system, comprising:

[0049] Malicious code library, which contains some discovered malicious codes;

[0050] A malicious code analysis module, which is connected to the malicious code library and can periodically analyze the codes stored in the malicious code library to classify the malicious codes stored in the malicious code library into families and study the relationship between malicious codes of the same family;

[0051] An interaction data identification module, which can identify the interaction data according to the interaction type;

[0052] The interactive data analysis module is connected to the interactive data identification module, the malicious code analysis module and the malicious code library respectively, and can compare the interactive data with the stored malicious code to determine the security of the interactive data; for the interactive data to be determined as malicious data, the interactive data analysis module can classify it into categories or introduce new categories.

[0053] The present invention provides a network attack situation intelligent identification method based on a power monitoring system, based on the above system, comprising:

[0054] The malicious code analysis module converts the malicious code stored in the malicious code library into grayscale images and performs convolution operations on the grayscale images to generate different levels;

[0055] The malicious code analysis module extracts and analyzes features of each of the layers to obtain malicious features of each malicious code, and classifies each malicious code into families according to malicious feature relationships to determine relationships between malicious codes of the same family;

[0056] The interactive data analysis module characterizes the data to be identified after being identified by the interactive data identification module, and compares its characteristics with the malicious characteristics to find similar codes at different levels of the data to be identified;

[0057] Analyze similar codes at different levels to determine whether the data to be identified is malicious data, and determine the malicious code relationship of the data to be identified after it is determined to be malicious data.

[0058] The present invention processes the interactive data in an image format and compares the extracted features with preset malicious features to determine whether it belongs to an existing malicious code family. For those that do not belong to the existing malicious code family, the features are judged to determine whether the interactive data belongs to a new malicious feature family. The present application can discover new malicious codes and ensure the stability of the power system operation.

[0059] The malicious code library numbers the malicious codes stored therein;

[0060] For any malicious code, the malicious code analysis module maps it to form a grayscale image corresponding to it, and extracts features from the grayscale image to generate a set of structural features of a single malicious code;

[0061] The malicious code library stores m malicious codes in the initial stage, which are respectively recorded as the first malicious code A1, the second malicious code A2, ..., and the mth malicious code Am.

[0062] For any malicious code Ai, i = 1, 2, ..., m, it is mapped to form a corresponding grayscale image, and the grayscale image is feature extracted and numbered, which are respectively recorded as the first feature Bi 1 of the malicious code Ai, the second feature Bi2 of the malicious code Ai, ..., the nith feature Bin i of the malicious code Ai, ni is the number of features extracted from the malicious code Ai;

[0063] The malicious code analysis module compares and analyzes the features of each malicious code.

[0064] For any feature Bi j, j = 1, 2, ..., ni of any malicious code Ai, compare it with the features of other malicious codes one by one. For any feature Bi'j' to be compared, its repetition with the feature Bi j is C(Bij_Bi'j'), i' = 1, 2, ..., m, and i' ≠ i, j' = 1, 2, ..., ni', ni' is the number of features extracted from the malicious code Ai';

[0065] If C(Bi j_Bi'j')≥C1, the malicious code analysis module determines that feature Bi j and feature Bi'j' are similar features;

[0066] If C2≤C(Bi j_Bi'j')<C1, the malicious code analysis module determines that feature Bi j and feature Bi'j' are related features;

[0067] If C(Bi j_Bi'j')≤C2, the malicious code analysis module determines that feature Bi j and feature Bi'j' are unrelated features.

[0068] C1 is the first evaluation value of feature similarity, C2 is the second evaluation value of feature similarity, and C1<C2.

[0069] Malicious code must contain several malicious features, and there is a certain correlation between malicious features of the same type. By comparing the features between malicious codes, we can determine the features with higher similarity in the malicious code, and determine the similarity relationship between the features based on the similarity. By obtaining similar features, we can find the malicious features in the malicious code and lay the foundation for determining the data to be interacted.

[0070] Integrate the features of the grayscale images after the malicious codes are extracted to obtain a number of similar features, and mark the obtained number of similar features as malicious features;

[0071] Integrate and cluster the malicious features to generate malicious feature clusters, and analyze each malicious code to classify the malicious code into categories;

[0072] Convolution processing is performed on each of the grayscale images to obtain data features of the convolution layer, pooling layer, fully connected layer and output layer respectively, and the data features of any layer are integrated to obtain several similar features to generate a malicious data feature set of each layer.

[0073] The malicious code analysis module marks the features determined to be similar features as first-level malicious features of the grayscale image, and marks the features determined to be related features as second-level malicious features of the grayscale image;

[0074] If feature Bi j is marked as a similar feature, a relevant feature, and an irrelevant feature when compared with other different features, the malicious code analysis module marks it as a first-level malicious feature of the grayscale image; if feature Bi j is marked as a relevant feature and an irrelevant feature when compared with other different features, the malicious code analysis module marks it as a second-level malicious feature of the grayscale image.

[0075] Malicious features are graded by similarity to ensure the accuracy of malicious code identification.

[0076] The malicious code analysis module integrates the determined first-level malicious features of the grayscale image and the second-level malicious features of the grayscale image to generate a first-level malicious feature set of the grayscale image and a second-level malicious feature set of the grayscale image.

[0077] For malicious code Ai and malicious code Ai', the malicious code analysis module analyzes and compares the data features of the convolution layer, pooling layer, fully connected layer and output layer according to the feature comparison analysis method of the grayscale image, and obtains the first-level malicious feature set of the convolution layer, the second-level malicious feature set of the convolution layer, the first-level malicious feature set of the fully connected layer, the second-level malicious feature set of the fully connected layer, the first-level malicious feature set of the pooling layer, the second-level malicious feature set of the pooling layer, the first-level malicious feature set of the output layer, and the second-level malicious feature set of the output layer one by one.

[0078] Different levels of data are judged one by one, and the malicious feature set of each level is determined respectively, which enriches the samples of malicious features and makes the analysis of interactive data more accurate.

[0079] The number of similar features contained in the grayscale image of the malicious code Ai and the malicious code Ai' is P11, and the number of related features contained is P12. The malicious code analysis module calculates the correlation degree of the malicious code Ai' to the malicious code Ai in the grayscale image;

[0080] Calculate the correlation score F1 of the malicious code Ai' for the grayscale image, and set F1 = P11 ÷ ni × Q1 + P12 ÷ ni × Q2, where Q1 is the first compensation parameter of the grayscale image correlation score, and Q2 is the second compensation parameter of the grayscale image correlation score.

[0081] By determining the number of similar features and related features between malicious codes, the correlation score of a malicious code to another malicious code is calculated, thereby determining the correlation between the codes. When calculating the correlation score, the proportion of similar features and related features in the number of features of another malicious code is considered to ensure the accuracy of the calculation results.

[0082] If F1≥Fz1, it is determined that the malicious code Ai' is the same type of malicious code Ai in the grayscale image;

[0083] If Fz2≤F1<Fz1, it is determined that the malicious code Ai' is the approximate code of the malicious code Ai in the grayscale image;

[0084] If F1<Fz2, it is determined that the malicious code Ai' has no approximate relationship with the malicious code Ai in the grayscale image;

[0085] Among them, Fz1 is the first evaluation value of the grayscale image code relationship, and Fz2 is the second evaluation value of the grayscale image code relationship;

[0086] The malicious code analysis module performs approximate relationship analysis on any malicious code Ai and other malicious codes one by one, and generates a relationship tree of the malicious code Ai in the grayscale image;

[0087] The malicious code analysis module performs approximate relationship analysis on all malicious codes and generates a relationship map of the malicious codes in the grayscale image.

[0088] By comparing the correlation scores of a certain malicious code to another malicious code in a digital way, determining the relationship tree of the other malicious code, and integrating several relationship trees, a relationship map of malicious codes at the same level is generated to clarify the relationship between malicious codes. This ensures that when the maliciousness of the interactive data is determined, the correlation of the malicious features of the data to be interacted can be determined, laying the foundation for determining the category division of the data to be interacted or introducing new categories.

[0089] The malicious code analysis module determines the relationship graphs of the malicious code in the convolution layer, the pooling layer, the fully connected layer and the output layer respectively according to the relationship graph determination method of the grayscale image.

[0090] The relationship between data at different levels is determined one by one, and the malicious code relationship map at each level is determined respectively, which enriches the samples of the malicious code relationship map and makes the analysis of interactive data more accurate.

[0091] The interaction data identification module determines the interaction type of the interaction data, and determines the monitoring degree of the interaction data according to the interaction type;

[0092] The interactive data analysis module extracts codes from the data to be interacted with, and maps the extracted codes to generate a grayscale image to be identified. The interactive data analysis module extracts features from the grayscale image to be identified and numbers them, which are recorded as the first feature D1 to be identified in the grayscale image, the second feature D2 to be identified in the grayscale image, ..., the kth feature Dk to be identified in the grayscale image,

[0093] For any grayscale image feature D l to be identified, l = 1, 2, ..., k, it is compared with the features of the first-level malicious feature set and the second-level malicious feature set of the grayscale image one by one. For any grayscale image malicious feature Bij, its similarity with the grayscale image feature D l to be identified is Hi j

[0094] If Hi j≥H1, the interactive data analysis module determines that the grayscale image feature to be identified D l and the malicious feature Bij are similar features; H1 is the similarity evaluation value.

[0095] The interactive data analysis module analyzes the features of all the interactive data in the grayscale image, and selects the malicious code with the highest matching degree with its similar features as the grayscale image similar code.

[0096] The similar feature matching degree is set to M, M = (α×z1+β×z2)×Z, wherein α is the number of similar features determined between the data to be interacted and the malicious code Ai in the first-level malicious feature set of the grayscale image; β is the number of similar features determined between the data to be interacted and the malicious code Ai in the second-level malicious feature set of the grayscale image; z1 is the first calculation adjustment parameter of the similar feature matching degree, z2 is the second calculation adjustment parameter of the similar feature matching degree, and Z is the similar feature matching degree calculation control value. For the similar feature matching degree calculation control value Z, Z = k÷ni+Z1, and Z1 is the similar feature matching degree calculation control basic value.

[0097] By characterizing the data to be identified and comparing its characteristics with the characteristics of each malicious code, similar codes at different levels of the data to be identified are found, and by analyzing similar codes at different levels, the security of the data to be identified is determined.

[0098] The interactive data analysis module determines the similar codes of the data to be interacted in the convolution layer, the pooling layer, the fully connected layer and the output layer one by one;

[0099] If the similar codes exist in the same malicious code relationship tree, the data to be interacted with is determined to be a branch of the relationship tree and is determined to be malicious data.

[0100] When similar codes at all levels exist in different hierarchical relationship trees of a malicious code, it means that the data to be identified has a very high match with a malicious code. The data to be identified is determined to be a branch of the relationship tree and is determined to be malicious data, thereby ensuring the security of the power network.

[0101] If the similar codes do not exist in the relationship tree of the same malicious code, the interaction data is analyzed again to determine whether it is malicious data;

[0102] It is assumed that the similarity feature matching degree of the similarity code of the grayscale image of the data to be interacted is R1;

[0103] The similarity feature matching degree of similar codes in the convolutional layer of the data to be interacted is R2;

[0104] The similarity feature matching degree of similar codes in the pooling layer of the data to be interacted is R3;

[0105] The similarity feature matching degree of similar codes in the fully connected layer of the data to be interacted is R4;

[0106] The similarity feature matching degree of similar codes in the output layer of the data to be interacted is R5;

[0107] RP=R1+R2+R3+R4+R5,

[0108] If RP≥Rz, the data to be interacted is determined to be malicious data, and no malicious code has been entered. The data to be interacted is entered into the malicious code library, and the relationship tree and relationship map are determined;

[0109] If RP<Rz, it is determined that the data to be interacted is not malicious data.

[0110] RP is the total value of similar feature matching, and Rz is the evaluation value of the total value of similar feature matching.

[0111] For the data to be identified whose relationship tree cannot be determined, by integrating its similar feature matching degree with similar codes at each level, it is determined whether it is a new unidentified malicious code. If it is judged to be, the data to be interacted will be entered into the malicious code library, and its relationship tree and relationship map will be determined to enrich the number of malicious codes, and new malicious codes will be identified and supplemented.

[0112] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0113] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network attack situation intelligent identification method based on a power monitoring system, characterized in that: include, The malicious code analysis module converts the malicious code stored in the malicious code library into grayscale images and performs convolution operations on the grayscale images to generate different layers, including: convolution layer, pooling layer, fully connected layer and output layer; The malicious code analysis module extracts and analyzes features of each layer to obtain malicious features of each malicious code, and classifies each malicious code into families according to malicious feature relationships to determine relationships between malicious codes of the same family; The malicious code library numbers the malicious codes stored therein; For any malicious code, the malicious code analysis module maps it to form a grayscale image corresponding to it, and extracts features from the grayscale image to generate a set of structural features of a single malicious code in the grayscale image; The malicious code library performs convolution operation on the acquired grayscale image to obtain data feature sets of the malicious code in the convolution layer, the pooling layer, the fully connected layer and the output layer respectively; The malicious code analysis module compares and analyzes the features of the malicious codes of the layers, determines the malicious features of each layer, and generates a malicious feature set; The malicious code analysis module compares the features of different malicious codes in the grayscale image in pairs, and determines whether the compared features are malicious features based on the repetition between the features; The malicious code analysis module determines the feature relationship between the features according to the different repetitions between the features, and the feature relationship includes similar features, related features and unrelated features; The malicious code analysis module marks the features determined to be similar features as first-level malicious features of the grayscale image, and marks the features determined to be related features as second-level malicious features of the grayscale image; If any feature is marked as a similar feature, a related feature, and an irrelevant feature respectively when compared with other different features, the malicious code analysis module marks it as a first-level malicious feature of the grayscale image; If any feature is marked as a relevant feature and an irrelevant feature respectively when compared with other different features, the malicious code analysis module marks it as a second-level malicious feature of the grayscale image; The malicious code analysis module integrates the determined first-level malicious features of the grayscale image and the second-level malicious features of the grayscale image to generate a first-level malicious feature set of the grayscale image and a second-level malicious feature set of the grayscale image; The malicious code analysis module analyzes and compares the data features of the convolution layer, the pooling layer, the fully connected layer and the output layer according to the feature comparison analysis method for the grayscale image, and obtains the first-level malicious feature set of the convolution layer, the second-level malicious feature set of the convolution layer, the first-level malicious feature set of the fully connected layer, the second-level malicious feature set of the fully connected layer, the first-level malicious feature set of the pooling layer, the second-level malicious feature set of the pooling layer, the first-level malicious feature set of the output layer, and the second-level malicious feature set of the output layer one by one; The malicious code analysis module integrates and clusters the malicious features of the same layer to generate malicious feature clusters, and analyzes each malicious code to classify the malicious code into categories; For any two different malicious codes, the malicious code analysis module analyzes the number of similar features and related features between them, and determines the family relationship of the two malicious codes in the same layer of data; The interactive data analysis module characterizes the data to be interacted with after being identified by the interactive data identification module, and compares the characteristics of the data to be interacted with each of the malicious characteristics to find similar codes at different layers of the data to be interacted with; Analyze similar codes at different layers to determine whether the data to be interacted is malicious data, and determine the malicious code relationship of the data to be interacted after it is determined to be malicious data; The interactive data analysis module extracts codes from the data to be interacted with, and performs mapping processing on the extracted codes to generate grayscale images to be identified. The interactive data analysis module extracts features from the grayscale images to be identified and numbers them; The interactive data analysis module compares all the features of the interactive data in the grayscale image with the malicious features of the grayscale image one by one. For any feature to be identified in the grayscale image, the interactive data analysis module compares it with the features of the first-level malicious feature set of the grayscale image and the second-level malicious feature set of the grayscale image one by one to obtain similar features; The interactive data analysis module analyzes all the features of the data to be interacted with in the grayscale image, and selects the malicious code with the highest matching degree with the similar features of the data to be interacted with as the grayscale image similar code; The interactive data analysis module determines the similar codes of the data to be interacted in the convolution layer, the pooling layer, the fully connected layer and the output layer one by one; If the similar codes exist in the same malicious code relationship tree, the data to be interacted is determined to be a branch of the relationship tree and is determined to be malicious data; If the similar codes do not exist in the relationship tree of the same malicious code, the interactive data is analyzed again, and whether it is malicious data is determined based on the result of the re-analysis.

Images