A novel log attack detection method and system for power system
By building a knowledge graph and using technical means such as Bert and BiLSTM models, we can identify and amplify the log attack characteristics of new power systems, and solve the problem of poor log attack detection in the existing technology, achieving more efficient unknown attack recognition and Generalization.
Patent Information
- Application Number
- CN202410620380.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-20
- Publication Date
- 2024-12-31
- Estimated Expiration
- 2044-05-20
AI Technical Summary
The log attack detection method of the existing new power system is based on limited attack data samples, making it difficult to deal with unknown and random attack behaviors, resulting in poor detection results.
By obtaining historical log attack information, building a knowledge graph, obtaining the attack nodes of the current log and randomly replacing them, extracting node neighborhood information, inputting them into the Bert model and BiLSTM model for training, combining the hyperspherical volume minimization algorithm and multi-feature learning to identify Attack features and amplify the generalization of unknown attacks.
It improves the efficiency and generalization of the new power system log attack detection, and can more effectively identify and deal with unknown attack behaviors.
Smart Images
Figure CN118484772B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of novel power systems, and in particular to a log attack detection method and system for a novel power system. Background Art
[0002] In recent years, the system structure and form of new power systems have undergone profound changes. The application of digital technology enables new power systems to achieve comprehensive perception and highly intelligent operation, and strengthen the flexible coordination and interconnection between sources, networks, loads, and storage. However, it also brings network security risks to new power systems, which has an impact on existing technical architectures and security protection systems. Existing technologies for security risk detection mainly extract attack patterns through log detection of known attacks, and establish knowledge graphs to construct attack data. Based on the establishment of knowledge graphs to construct attack data, log attack detection of new power systems is carried out;
[0003] However, the above detection method only constructs a data set based on limited attack data samples, which is easily affected by the attack data set it relies on. Therefore, it is difficult to deal with unknown and random attack behaviors, resulting in insufficient utilization of the generated unknown attack samples, and the construction of different attack learning heads to analyze the differences between unknown attacks and normal behaviors cannot meet the generalization requirements, so that the effect of log attack detection in new power systems is not good. Therefore, a new log attack detection method for power systems is needed to solve the above problems. Summary of the invention
[0004] The purpose of the present invention is to provide a novel log attack detection method and system for a power system to solve the technical problems raised in the above background technology.
[0005] To achieve the above object, the present invention provides the following technical solutions:
[0006] A new type of power system log attack detection method is applied to the new type of power system, including:
[0007] Obtain historical log attack information, and construct knowledge graph data according to the historical log attack information, and construct timestamps for the knowledge graph data in chronological order, and obtain the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information;
[0008] Obtaining a second attack node of the current log, and randomly replacing the second attack node of the current log according to the first attack node of the log attack and the upper and lower connection relationship of the first node, to obtain an attack event sequence;
[0009] Extracting information from the second attack nodes between two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and classifying the multiple node neighborhood information based on the attack graph enhancement method to obtain attack neighborhood data and normal neighborhood data;
[0010] Input multiple node neighborhood information into the Bert model for training to obtain a semantic feature vector;
[0011] Multiple node neighborhood information is input into the BiLSTM model for training to obtain the time series feature vector;
[0012] Inputting the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector;
[0013] Based on the hypersphere volume minimization algorithm, the fused feature vector is identified to obtain the attack feature information;
[0014] Based on multi-feature learning, the attack feature information is classified into attack characteristics to obtain unknown attacks and normal attacks. The unknown attacks are compared with normal attacks to obtain multiple attack differences. According to the multiple attack differences, the unknown attack mode is amplified to achieve generalization of unknown attacks.
[0015] Preferably, the step of obtaining the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information includes:
[0016] Mark the number of log attacks in a unit time to obtain marked attack position information, and use the marked attack position information as attack node information;
[0017] Acquire attack text information according to the log attack, and acquire word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar;
[0018] Acquiring semantic information based on the text vocabulary and grammar;
[0019] Acquire context information in the attack text information according to the semantic information;
[0020] The connection relationship of the marked attack position information is extracted according to the context information to obtain the upper and lower connection relationship information of the nodes.
[0021] Preferably, the step of randomly replacing the attack nodes of the current log according to the attack nodes of the log attack and the node upper and lower connection relationship to obtain the attack event sequence includes:
[0022] Add corresponding noise edges to the attack nodes and node upper and lower connection relationships of the log attack to obtain the attack node noise edges and node upper and lower connection relationship noise edges;
[0023] Associating the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence;
[0024] Sort multiple associated node information based on timestamps to obtain associated node sorting information;
[0025] The attack sequences corresponding to the system events are randomly replaced and integrated according to the associated node sorting information to obtain an attack event sequence.
[0026] Preferably, the step of inputting the neighborhood information of multiple nodes into the Bert model for training to obtain the semantic feature vector comprises:
[0027] Acquire multiple feature vector factors of neighborhood information of multiple nodes, and split the multiple feature vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors;
[0028] Multiple time sequence vector factors, multiple node association semantic vector factors, and multiple up-down connection relationship vector factors are input into the Bert model for training to obtain a semantic feature vector, where the function formula of the Bert model is:
[0029]
[0030] L(l) represents the semantic feature vector, t(s)i represents the i-th time sequence vector factor, j(d)i represents the i-th node association semantic vector factor, g(j)i represents the i-th contextual connection relationship vector factor, where i represents the number of the time sequence vector factor, node association semantic vector factor and contextual connection relationship vector factor, i=1, 2, 3...n.
[0031] Preferably, the step of inputting multiple node neighborhood information into the BiLSTM model for training to obtain a time series feature vector includes:
[0032] Acquire multiple time vectors according to multiple node neighborhood information, and acquire corresponding time offset vectors and time vector weight values according to the time vectors;
[0033] Acquire a plurality of corresponding order vectors according to a plurality of node neighborhood information, and acquire corresponding order vector weight values according to the order vectors;
[0034] The multiple time vectors, time offset vectors, time vector weight values, multiple order vectors and order vector weight values are input into the BiLSTM model for training to obtain a time series feature vector, wherein the function formula of the BiLSTM model is:
[0035]
[0036] s(x) represents the time series feature vector, s(j) represents the time vector, p(z) represents the time bias vector, β represents the time vector weight value, s(x) represents the order vector, γ represents the order vector weight value, where k represents the number of the time vector and the order vector, k=1, 2, 3...n.
[0037] Preferably, the step of comparing the unknown attack with the normal attack to obtain multiple attack differences, and enhancing the generalization of the unknown attack according to the multiple attack differences comprises:
[0038] Extracting multiple feature values of the unknown attack and the normal attack based on a convolutional neural network, and classifying the multiple feature values according to the highest k features of the convolutional neural network to obtain visible attack feature values, potential residual unknown attack values, and adversarial attack feature values;
[0039] The visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value are calculated by averaging the feature values to obtain the balanced attack feature value;
[0040] The average attack difference is obtained according to the balanced attack feature value, and the visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value are compared according to the average attack difference to obtain multiple attack differences, and the unknown attack mode is amplified according to the multiple attack differences to achieve generalization of unknown attacks.
[0041] The present application also provides a novel log attack detection system for a power system, comprising:
[0042] The first acquisition module is used to obtain historical log attack information, and construct knowledge graph data according to the historical log attack information, and construct timestamps for the knowledge graph data information in chronological order, and obtain the attack nodes and node upper and lower connection relationships of the log attack according to the timestamp information;
[0043] A first replacement module is used to randomly replace the attack nodes of the current log according to the attack nodes of the log attack and the node upper and lower connection relationship to obtain an attack event sequence;
[0044] A first classification module is used to extract information from two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and classify the multiple node neighborhood information based on the attack graph enhancement method to obtain attack neighborhood data and normal neighborhood data;
[0045] The first training module is used to input the neighborhood information of multiple nodes into the Bert model for training to obtain a semantic feature vector;
[0046] In the second training module, multiple node neighborhood information is input into the BiLSTM model for training to obtain the time series feature vector;
[0047] A first fusion module is used to input the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector;
[0048] The first recognition module is used to perform feature recognition on the fused feature vector based on a hypersphere volume minimization algorithm to obtain attack feature information;
[0049] The first generalized attack module is used to classify attack characteristics of attack feature information based on multi-feature learning, obtain unknown attacks and normal attacks, and compare the unknown attacks with normal attacks to obtain multiple attack differences, and amplify the unknown attack methods according to the multiple attack differences to achieve generalization of unknown attacks.
[0050] Preferably, the first acquisition module includes:
[0051] A first acquisition unit is used to mark the number of log attacks in a unit time, obtain marked attack position information, and use the marked attack position information as attack node information;
[0052] A second acquisition unit is used to acquire attack text information according to the log attack, and acquire word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar;
[0053] A third acquisition unit, used to acquire semantic information according to the text vocabulary and grammar;
[0054] A fourth acquisition unit, configured to acquire context information in the attack text information according to the semantic information;
[0055] The first extraction unit is used to extract the connection relationship of the marked attack position information according to the context information to obtain the upper and lower connection relationship information of the nodes.
[0056] Preferably, the first replacement module comprises:
[0057] The first adding unit is used to add corresponding noise edges to the attack node and the node upper and lower connection relationship of the log attack, so as to obtain the attack node noise edge and the node upper and lower connection relationship noise edge;
[0058] A first association unit is used to associate the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence;
[0059] A first sorting unit, used to sort the plurality of associated node information based on the timestamp to obtain associated node sorting information;
[0060] The first integration unit is used to perform random replacement integration according to the attack sequence corresponding to the associated node sorting information to obtain an attack event sequence.
[0061] Preferably, the first training module includes:
[0062] A fourth acquisition unit is used to acquire multiple characteristic vector factors of the neighborhood information of multiple nodes, and to split the multiple characteristic vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors respectively;
[0063] The first training unit is used to input multiple time sequence vector factors, multiple node association semantic vector factors and multiple up-and-down connection relationship vector factors into the Bert model for training to obtain a semantic feature vector, wherein the function formula of the Bert model is:
[0064]
[0065] L(l) represents the semantic feature vector, t(s)i represents the i-th time sequence vector factor, j(d)i represents the i-th node association semantic vector factor, g(j)i represents the i-th contextual connection relationship vector factor, where i represents the number of the time sequence vector factor, node association semantic vector factor and contextual connection relationship vector factor, i=1, 2, 3...n.
[0066] The beneficial effects of the present application are as follows: the present application first obtains semantic feature vectors and time series feature vectors through a model, then inputs the semantic feature vectors and time series feature vectors into a feature fusion model for training to obtain a fused feature vector, performs feature recognition on the fused feature vector based on a hypersphere volume minimization algorithm to obtain attack feature information, so that after obtaining the attack feature information, the attack feature information can be quickly distinguished, and then the attack feature information is classified into attack characteristics based on multi-feature learning to obtain unknown attacks and normal attacks, and the unknown attacks are compared with the normal attacks to obtain multiple attack differences, and the unknown attack methods are amplified according to the multiple attack differences to achieve generalization of unknown attacks, thereby improving the efficiency of log attack detection in new power systems. BRIEF DESCRIPTION OF THE DRAWINGS
[0067] Figure 1 The figure is a schematic diagram of a method flow of an embodiment of the present application.
[0068] Figure 2 A schematic diagram of the system structure of an embodiment of the present application.
[0069] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0070] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0071] like Figure 1-2 As shown, the present application provides a log attack detection method for a new power system, which is applied to the new power system, including:
[0072] S1. Obtain historical log attack information, construct knowledge graph data according to the historical log attack information, construct timestamps for the knowledge graph data in chronological order, and obtain the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information;
[0073] S2, obtaining the second attack node of the current log, and randomly replacing the second attack node of the current log according to the first attack node of the log attack and the upper and lower connection relationship of the first node, to obtain an attack event sequence;
[0074] S3, extracting information from the second attack nodes between two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and classifying the multiple node neighborhood information based on the attack graph enhancement method to obtain attack neighborhood data and normal neighborhood data;
[0075] S4, inputting multiple node neighborhood information into the Bert model for training to obtain a semantic feature vector;
[0076] S5, inputting multiple node neighborhood information into the BiLSTM model for training to obtain a time series feature vector;
[0077] S6, inputting the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector;
[0078] S7, performing feature recognition on the fused feature vector based on a hypersphere volume minimization algorithm to obtain attack feature information;
[0079] S8. Based on multi-feature learning, the attack feature information is classified into attack characteristics to obtain unknown attacks and normal attacks, and the unknown attacks are compared with the normal attacks to obtain multiple attack differences. The unknown attack methods are amplified according to the multiple attack differences to achieve generalization of unknown attacks.
[0080] As described in the above steps S1-S8, since the existing log attack detection method only constructs a data set based on a limited number of attack data samples, it is easily affected by the attack data set it relies on. Therefore, it is difficult to deal with unknown and random attack behaviors, which leads to insufficient utilization of the generated unknown attack samples, so that the differences between unknown attacks and normal behaviors constructed by different attack learning heads cannot meet the generalization requirements, so that the effect of log attack detection in the new power system is not good. Based on this, historical log attack information is first obtained, and knowledge graph data is constructed based on the historical log attack information. The knowledge graph data constructed in this way can extract multiple types of attack data, and then the timestamps are constructed for the knowledge graph data in sequence. The first attack node of the log attack and the upper and lower connection relationship of the first node are obtained according to the timestamp information. The timestamp information constructed in this way can reflect the position of the log attack detection in each period and the situation between adjacent nodes, and the second attack node of the current log is obtained, and the second attack node of the current log is randomly replaced according to the first attack node of the log attack and the upper and lower connection relationship of the first node to obtain the attack event sequence. In this way, the attack event sequence is obtained by random Replacement can increase the diversity of attack samples, and then extract information from the second attack nodes between two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and then input the multiple node neighborhood information into the Bert model for training in turn to obtain semantic feature vectors, and then input the multiple node neighborhood information into the BiLSTM model for training to obtain time series feature vectors, so that multiple data can be batch trained, and then semantic feature vectors and time series feature vectors can be quickly obtained, and then the semantic feature vectors and time series feature vectors are input into the feature fusion model for training to obtain fused feature vectors, and feature recognition is performed on the fused feature vector based on the hypersphere volume minimization algorithm to obtain attack feature information, so that the attack feature information can be quickly distinguished after obtaining the attack feature information, and then the attack feature information is classified based on multi-feature learning to obtain unknown attacks and normal attacks, and the unknown attacks and normal attacks are compared to obtain multiple attack differences, and the unknown attack mode is amplified according to the multiple attack differences to achieve the generalization of unknown attacks, thereby improving the efficiency of log attack detection of new power systems.
[0081] In one embodiment, the step S1 of obtaining the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information includes:
[0082] S101, marking the number of log attacks in a unit time, obtaining marked attack position information, and using the marked attack position information as attack node information;
[0083] S102, acquiring attack text information according to the log attack, and acquiring word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar;
[0084] S103, acquiring semantic information according to the text vocabulary and grammar;
[0085] S104, acquiring context information in the attack text information according to the semantic information;
[0086] S105 , extracting the connection relationship of the marked attack position information according to the context information to obtain the upper and lower connection relationship information of the nodes.
[0087] As described in the above steps S101-S105, since the log attack detection has specific attributes, it is necessary to extract the characteristics of the data attack, specifically: first mark the number of log attacks in a unit time to obtain the marked attack position information, and use the marked attack position information as the attack node information, then obtain the attack text information according to the log attack, and obtain the word information in the attack text information based on the self-attention mechanism, wherein the word information includes text vocabulary and grammar, so that when performing attack detection, it is possible to know what the attack text is, then obtain semantic information according to the text vocabulary and grammar, and then obtain the contextual information in the attack text information according to the semantic information, so that the connection relationship of the marked attack position information is extracted according to the contextual information to obtain the upper and lower connection relationship information, and then obtain the upper and lower connection relationship information to know the characteristic attributes during attack detection, wherein the characteristic attribute is the type during attack detection, and the type includes probabilistic attack, resource exhaustion attack and zero-day vulnerability attack, etc.
[0088] In one embodiment, the step S2 of randomly replacing the attack nodes of the current log according to the attack nodes of the log attack and the node upper and lower connection relationship to obtain the attack event sequence includes:
[0089] S201, adding corresponding noise edges to the attack nodes and node upper and lower connection relationships of the log attack, to obtain attack node noise edges and node upper and lower connection relationship noise edges;
[0090] S202, associating the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence;
[0091] S203, sorting the plurality of associated node information based on the timestamp to obtain associated node sorting information;
[0092] S204: Randomly replace and integrate the attack sequences corresponding to the system events according to the associated node sorting information to obtain an attack event sequence.
[0093] As described in the above steps S201-S204, since increasing the complexity of the attack node can increase the diversity of the attack sequence, based on this, first add corresponding noise edges to the attack nodes and the node upper and lower connection relationships of the log attack to obtain the attack node noise edges and the node upper and lower connection relationship noise edges, so that the attack node noise edges and the node upper and lower connection relationship noise edges can increase the complexity of the attack sequence, and then associate the attack node noise edges and the node upper and lower connection relationship noise edges with the corresponding system events to obtain multiple associated node information, wherein the system events include computer systems, mechanical systems, electrical systems and biological systems, and each system event corresponds to an attack sequence, and then sort the multiple associated node information based on the timestamp to obtain associated node sorting information, and then randomly replace and integrate the attack sequence corresponding to the system event according to the associated node sorting information to obtain the attack event sequence, so that the attack event sequence obtained after integration can improve the generalization of the attack, so that the log attack detection of the new power system will not be affected by a single data.
[0094] In one embodiment, the step S4 of inputting the neighborhood information of multiple nodes into the Bert model for training to obtain the semantic feature vector includes:
[0095] S401, obtaining multiple characteristic vector factors of neighborhood information of multiple nodes, and splitting the multiple characteristic vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors;
[0096] S402, input multiple time sequence vector factors, multiple node association semantic vector factors and multiple upper and lower connection relationship vector factors into the Bert model for training to obtain a semantic feature vector, wherein the function formula of the Bert model is:
[0097]
[0098] L(l) represents the semantic feature vector, t(s)i represents the first i time sequence vector factors, j(d)i represents the first i node association vector factors, g(j)i represents the first i attack operation vector factors, where i represents the number of the time sequence vector factor, node association vector factor and attack operation vector factor, i=1, 2, 3...n.
[0099] As described in the above steps S401-S402, first obtain multiple feature vector factors of multiple node neighborhood information, and then obtain multiple feature vector factors of multiple node neighborhood information, and split the multiple feature vector factors into multiple time sequence vector factors, multiple node-related semantic vector factors, and multiple up-and-down relationship vector factors. The characteristics of the attack obtained by segmentation can make the trained sample data more accurate. Then, the multiple feature vector factors are split into multiple time sequence vector factors, multiple node-related semantic vector factors, and multiple up-and-down relationship vector factors, and input them into the Bert model for training to obtain semantic feature vectors. By specifically splitting the multiple feature vector factors into multiple time sequence vector factors, multiple node-related semantic vector factors, and multiple up-and-down relationship vector factors for integration, the obtained semantic feature vectors can fully reflect the attack semantic characteristics of the node interval, and determine whether a given log sequence is an attack sequence through the attack semantic characteristics, so that the obtained attack sequence has use value.
[0100] In one embodiment, the step S5 of inputting multiple node neighborhood information into the BiLSTM model for training to obtain a time series feature vector includes:
[0101] S501, obtaining multiple time vectors of normal neighborhood data according to multiple node neighborhood information, and obtaining corresponding time offset vectors and time vector weight values according to the time vectors;
[0102] S502, obtaining a plurality of corresponding order vectors according to a plurality of node neighborhood information, and obtaining corresponding order vector weight values according to the order vectors;
[0103] S503: Input the multiple time vectors, time offset vectors, time vector weight values, multiple order vectors and order vector weight values into a BiLSTM model for training to obtain a time series feature vector, wherein the function formula of the BiLSTM model is:
[0104]
[0105] s(x) represents the time series feature vector, s(j) represents the time vector, p(z) represents the time bias vector, β represents the time vector weight value, s(x) represents the order vector, γ represents the order vector weight value, where k represents the number of the time vector and the order vector, k=1, 2, 3...n.
[0106] As described in the above steps S501-S504, first, multiple time vectors of normal neighborhood data are obtained according to multiple node neighborhood information, and corresponding time bias vectors and time vector weight values are obtained according to the time vectors. Then, multiple corresponding order vectors are obtained according to the multiple node neighborhood information, and corresponding order vector weight values are obtained according to the order vectors. Then, the multiple time vectors, time bias vectors, time vector weight values, multiple order vectors and order vector weight values are input into the BiLSTM model for training to obtain a time series feature vector. The time series feature vector can be used to accurately obtain the relationship between the order and time of log attack detection, thereby better providing samples for log data.
[0107] In one embodiment, the novel power system performs generalized attack detection according to pseudo unknown attack data to obtain balanced attack data, and step S8 of balancing data samples for log attack detection according to the balanced attack data includes:
[0108] S801, the step of comparing the unknown attack with the normal attack to obtain multiple attack differences, and enhancing the generalization of the unknown attack according to the multiple attack differences, includes:
[0109] S802, extracting multiple feature values of the unknown attack and the normal attack based on a convolutional neural network, and classifying the multiple feature values according to the highest k features of the convolutional neural network to obtain visible attack feature values, potential residual unknown attack values, and adversarial attack feature values;
[0110] S803, calculating the feature average value of the visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value to obtain a balanced attack feature value;
[0111] S804. Obtain an average attack difference according to the balanced attack feature value, and compare the visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value according to the average attack difference to obtain multiple attack differences, and amplify the unknown attack mode according to the multiple attack differences to achieve generalization of the unknown attack.
[0112] As described in the above steps S801-S804, the present application first extracts multiple feature values of the pseudo-unknown attack data based on a convolutional neural network, and classifies the multiple feature values according to the highest k features of the convolutional neural network to obtain visible attack feature values, potential residual unknown attack values and adversarial attack feature values. The attack feature values extracted in this way can be coordinated to the type of the current attack, wherein the visible attack feature values, potential residual unknown attack values and adversarial attack feature values correspond to three attack sample sequences respectively, and the pseudo-unknown attack is obtained by a data enhancement method corresponding to a normal attack in a known attack sample. In the feature space, the pseudo-unknown attack is a sample with an abnormal residual compared to a normal sample; the visible attack in the adversarial attack feature value is: different feature values of the visible attack sample are extracted by different convolution kernels, while ensuring the learning feature The training method is consistent with the normal attack part, ensuring that the trained model can recognize and classify these mutated attack samples, potential residual unknown attack learning: it generates adversarial network attack samples through unknown attacks, and then calculates the feature average of visible attack feature values, potential residual unknown attack values and adversarial attack feature values to obtain balanced attack feature values, so that the data samples of log attack detection are balanced according to the balanced attack data, and then the average attack difference is obtained according to the balanced attack feature value, and the visible attack feature value, potential residual unknown attack value and adversarial attack feature value are compared according to the average attack difference to obtain multiple attack differences, and the unknown attack method is amplified according to the multiple attack differences to achieve generalization of unknown attacks, thereby improving the efficiency of log attack detection in new power systems.
[0113] The present application also provides a novel log attack detection system for a power system, comprising:
[0114] The first acquisition module 1 is used to obtain historical log attack information, and construct knowledge graph data according to the historical log attack information, and construct timestamps for the knowledge graph data information in chronological order, and obtain the attack nodes and node upper and lower connection relationships of the log attack according to the timestamp information;
[0115] The first replacement module 2 is used to randomly replace the attack nodes of the current log according to the attack nodes of the log attack and the node upper and lower connection relationship to obtain an attack event sequence;
[0116] The first classification module 3 is used to extract information from two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and classify the multiple node neighborhood information based on the attack graph enhancement method to obtain attack neighborhood data and normal neighborhood data;
[0117] The first training module 4 is used to input the neighborhood information of multiple nodes into the Bert model for training to obtain a semantic feature vector;
[0118] The second training module 5 inputs multiple node neighborhood information into the BiLSTM model for training to obtain a time series feature vector;
[0119] A first fusion module 6, used for inputting the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector;
[0120] The first recognition module 7 is used to perform feature recognition on the fused feature vector based on a hypersphere volume minimization algorithm to obtain attack feature information;
[0121] The first generalized attack module 8 is used to classify attack characteristics of attack feature information based on multi-feature learning, obtain unknown attacks and normal attacks, and compare the unknown attacks with normal attacks to obtain multiple attack differences, and amplify the unknown attack methods according to the multiple attack differences to achieve generalization of unknown attacks.
[0122] In one embodiment, the first acquisition module includes:
[0123] A first acquisition unit is used to mark the number of log attacks in a unit time, obtain marked attack position information, and use the marked attack position information as attack node information;
[0124] A second acquisition unit is used to acquire attack text information according to the log attack, and acquire word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar;
[0125] A third acquisition unit, used to acquire semantic information according to the text vocabulary and grammar;
[0126] A fourth acquisition unit, configured to acquire context information in the attack text information according to the semantic information;
[0127] The first extraction unit is used to extract the connection relationship of the marked attack position information according to the context information to obtain the upper and lower connection relationship information of the nodes.
[0128] In one embodiment, the first replacement module includes:
[0129] The first adding unit is used to add corresponding noise edges to the attack node and the node upper and lower connection relationship of the log attack, so as to obtain the attack node noise edge and the node upper and lower connection relationship noise edge;
[0130] A first association unit is used to associate the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence;
[0131] A first sorting unit, used to sort the plurality of associated node information based on the timestamp to obtain associated node sorting information;
[0132] The first integration unit is used to perform random replacement integration according to the attack sequence corresponding to the associated node sorting information to obtain an attack event sequence.
[0133] In one embodiment, the first training module includes:
[0134] A fourth acquisition unit is used to acquire multiple characteristic vector factors of the neighborhood information of multiple nodes, and to split the multiple characteristic vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors respectively;
[0135] The first training unit is used to input multiple time sequence vector factors, multiple node association semantic vector factors and multiple up-and-down connection relationship vector factors into the Bert model for training to obtain a semantic feature vector, wherein the function formula of the Bert model is:
[0136]
[0137] L(l) represents the semantic feature vector, t(s)i represents the i-th time sequence vector factor, j(d)i represents the i-th node association semantic vector factor, g(j)i represents the i-th contextual connection relationship vector factor, where i represents the number of the time sequence vector factor, node association semantic vector factor and contextual connection relationship vector factor, i=1, 2, 3...n.
[0138] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.
[0140] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A log attack detection method for a power system, applied to a power system, characterized in that: include: Obtain historical log attack information, and construct knowledge graph data according to the historical log attack information, and construct timestamps for the knowledge graph data in chronological order, and obtain the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information; Obtaining a second attack node of the current log, and randomly replacing the second attack node of the current log according to the first attack node of the log attack and the upper and lower connection relationship of the first node, to obtain an attack event sequence; Add corresponding noise edges to the attack nodes and node upper and lower connection relationships of the log attack to obtain the attack node noise edges and node upper and lower connection relationship noise edges; Associating the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence; Sort multiple associated node information based on timestamps to obtain associated node sorting information; According to the associated node sorting information, the attack sequence corresponding to the system event is randomly replaced and integrated to obtain an attack event sequence; Extracting information from two adjacent second attack nodes in the attack event sequence to obtain multiple node neighborhood information; Input multiple node neighborhood information into the Bert model for training to obtain a semantic feature vector; Multiple node neighborhood information is input into the BiLSTM model for training to obtain the time series feature vector; Inputting the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector; Based on the hypersphere volume minimization algorithm, the fused feature vector is identified to obtain the attack feature information; Based on multi-feature learning, the attack feature information is classified into attack characteristics to obtain unknown attacks and normal attacks. The unknown attacks are compared with normal attacks to obtain multiple attack differences. According to the multiple attack differences, the unknown attack mode is amplified to achieve generalization of unknown attacks.
2. The log attack detection method for the power system according to claim 1 is characterized in that: The step of obtaining the first attack node of the log attack and the upper and lower connection relationship of the first node according to the timestamp information includes: Mark the number of log attacks in a unit time to obtain marked attack position information, and use the marked attack position information as attack node information; Acquire attack text information according to the log attack, and acquire word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar; Acquiring semantic information based on the text vocabulary and grammar; Acquire context information in the attack text information according to the semantic information; The connection relationship of the marked attack position information is extracted according to the context information to obtain the upper and lower connection relationship information of the nodes.
3. The log attack detection method for the power system according to claim 1 is characterized in that: The step of inputting multiple node neighborhood information into the Bert model for training to obtain a semantic feature vector includes: Acquire multiple feature vector factors of neighborhood information of multiple nodes, and split the multiple feature vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors; Multiple time sequence vector factors, multiple node association semantic vector factors, and multiple up-down connection relationship vector factors are input into the Bert model for training to obtain a semantic feature vector, where the function formula of the Bert model is: ； L(I) represents the semantic feature vector, t(s)i represents the i-th time sequence vector factor, j(d)i represents the i-th node association semantic vector factor, g(j)i represents the i-th contextual connection relationship vector factor, where i represents the number of the time sequence vector factor, node association semantic vector factor and contextual connection relationship vector factor, i=1, 2, 3...n.
4. The log attack detection method for the power system according to claim 1 is characterized in that: The step of inputting multiple node neighborhood information into the BiLSTM model for training to obtain a time series feature vector includes: Acquire multiple time vectors according to multiple node neighborhood information, and acquire corresponding time offset vectors and time vector weight values according to the time vectors; Acquire a plurality of corresponding order vectors according to a plurality of node neighborhood information, and acquire corresponding order vector weight values according to the order vectors; The multiple time vectors, time offset vectors, time vector weight values, multiple order vectors and order vector weight values are input into a BiLSTM model for training to obtain a time series feature vector.
5. The method for detecting log attacks in a power system according to claim 1, characterized in that: The step of comparing the unknown attack with the normal attack to obtain multiple attack differences and enhancing the generalization of the unknown attack according to the multiple attack differences includes: Extracting multiple feature values of the unknown attack and the normal attack based on a convolutional neural network, and classifying the multiple feature values according to the highest k features of the convolutional neural network to obtain visible attack feature values, potential residual unknown attack values, and adversarial attack feature values; The visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value are calculated by averaging the feature values to obtain the balanced attack feature value; The average attack difference is obtained according to the balanced attack feature value, and the visible attack feature value, the potential residual unknown attack value and the adversarial attack feature value are compared according to the average attack difference to obtain multiple attack differences, and the unknown attack mode is amplified according to the multiple attack differences to achieve generalization of unknown attacks.
6. A log attack detection system for a power system, characterized in that: include: The first acquisition module is used to obtain historical log attack information, and construct knowledge graph data according to the historical log attack information, and construct timestamps for the knowledge graph data information in chronological order, and obtain the attack nodes and node upper and lower connection relationships of the log attack according to the timestamp information; A first replacement module is used to randomly replace the attack nodes of the current log according to the attack nodes of the log attack and the node upper and lower connection relationship to obtain an attack event sequence; Add corresponding noise edges to the attack nodes and node upper and lower connection relationships of the log attack to obtain the attack node noise edges and node upper and lower connection relationship noise edges; Associating the attack node noise edge and the node upper and lower connection relationship noise edge with the corresponding system event to obtain a plurality of associated node information, wherein the system event includes a computer system, a mechanical system, an electrical system and a biological system, and each system event corresponds to an attack sequence; Sort multiple associated node information based on timestamps to obtain associated node sorting information; According to the associated node sorting information, the attack sequence corresponding to the system event is randomly replaced and integrated to obtain an attack event sequence; A first classification module is used to extract information from two adjacent nodes in the attack event sequence to obtain multiple node neighborhood information, and classify the multiple node neighborhood information based on the attack graph enhancement method to obtain attack neighborhood data and normal neighborhood data; The first training module is used to input the neighborhood information of multiple nodes into the Bert model for training to obtain a semantic feature vector; In the second training module, multiple node neighborhood information is input into the BiLSTM model for training to obtain the time series feature vector; A first fusion module is used to input the semantic feature vector and the temporal feature vector into a feature fusion model for training to obtain a fused feature vector; The first recognition module is used to perform feature recognition on the fused feature vector based on a hypersphere volume minimization algorithm to obtain attack feature information; The first generalized attack module is used to classify attack characteristics of attack feature information based on multi-feature learning, obtain unknown attacks and normal attacks, and compare the unknown attacks with normal attacks to obtain multiple attack differences, and amplify the unknown attack methods according to the multiple attack differences to achieve generalization of unknown attacks.
7. A log attack detection system for a power system according to claim 6, characterized in that: The first acquisition module includes: A first acquisition unit is used to mark the number of log attacks in a unit time, obtain marked attack position information, and use the marked attack position information as attack node information; A second acquisition unit is used to acquire attack text information according to the log attack, and acquire word information in the attack text information based on a self-attention mechanism, wherein the word information includes text vocabulary and grammar; A third acquisition unit, used to acquire semantic information according to the text vocabulary and grammar; A fourth acquisition unit, configured to acquire context information in the attack text information according to the semantic information; The first extraction unit is used to extract the connection relationship of the marked attack position information according to the context information to obtain the upper and lower connection relationship information of the nodes.
8. The log attack detection system for a power system according to claim 6, characterized in that: The first training module includes: A fourth acquisition unit is used to acquire multiple characteristic vector factors of the neighborhood information of multiple nodes, and to split the multiple characteristic vector factors into multiple time sequence vector factors, multiple node association semantic vector factors, and multiple upper and lower connection relationship vector factors respectively; The first training unit is used to input multiple time sequence vector factors, multiple node association semantic vector factors and multiple up-and-down connection relationship vector factors into the Bert model for training to obtain a semantic feature vector, wherein the function formula of the Bert model is: ； L(I) represents the semantic feature vector, t(s)i represents the i-th time sequence vector factor, j(d)i represents the i-th node association semantic vector factor, g(j)i represents the i-th contextual connection relationship vector factor, where i represents the number of the time sequence vector factor, node association semantic vector factor and contextual connection relationship vector factor, i=1, 2, 3...n.