Power industrial control system intrusion detection method, device, medium and terminal

Abstract

The present application discloses an intrusion detection method and device, medium, and terminal for an electric power industrial control system, which relates to the field of computer network security technology, and the main purpose is to improve the problem of low accuracy of intrusion detection results when facing unknown target domain data. It includes: obtaining target network traffic data; based on the attack category label prediction model that has completed model training, performing prediction operations according to the target network traffic data to obtain the predicted attack category label of the target network traffic data, the attack category label prediction model is obtained by training the model based on the training set and test set of each source domain and based on the open domain generalization meta-learning algorithm; based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated, and the intrusion detection result of the target network traffic data is determined according to the classification confidence, and the intrusion detection result is the predicted attack category label or the unknown category label.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to an intrusion detection method and device, medium, and terminal for an electric power industrial control system. Background Art

[0002] In recent years, the security of power industrial control systems has attracted much attention. As an important national infrastructure, it plays a key role in the fields of economy, military, and medical care. With the increasing prominence of cyberspace security issues, the scale and frequency of attack incidents have increased year by year, and the network security situation of power industrial control systems has become increasingly severe. Due to the rapid development of emerging technologies such as 5G technology, industrial Internet, and cloud platform technology, the network technology of power industrial control systems is also constantly changing, and new forms and means of intrusion are constantly emerging. Traditional intrusion detection methods are often difficult to adapt to these new network intrusion scenarios, especially when facing attack avoidance methods such as hidden processes, the effectiveness of traditional intrusion detection methods is greatly reduced; and some malware can even lurk for a long time, control the victim's system and obtain sensitive information, which reduces the effectiveness of traditional intrusion detection methods, which poses a great threat to the security of power industrial control systems.

[0003] At present, in order to make up for the shortcomings of traditional intrusion detection methods, intrusion detection methods based on deep learning models have been widely used. In order to achieve excellent performance of deep learning models, model training based on large-scale labeled data is required. However, for target domains with unknown categories, it is difficult to obtain enough training data for the domain. In the case of insufficient training data, model training will overfit, which will lead to low accuracy of intrusion detection results when facing unknown target domain data. Summary of the invention

[0004] In view of this, the present application provides an intrusion detection method and device, medium, and terminal for an electric power industrial control system, the main purpose of which is to improve the problem of low accuracy of existing intrusion detection results when facing unknown target domain data.

[0005] According to one aspect of the present application, a method for detecting intrusion in an electric power industrial control system is provided, comprising:

[0006] Obtain target network traffic data;

[0007] Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label for the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on an open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains;

[0008] Obtain a similarity value between the target network traffic data and the source domain, as well as a prediction uncertainty value of the predicted attack category label, and calculate the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine the intrusion detection result of the target network traffic data according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label.

[0009] Preferably, before the attack category label prediction model based on the completed model training performs a prediction operation according to the target network traffic data to obtain the predicted attack category label of the target network traffic data, the method further includes:

[0010] constructing initial sub-models of each of the source domains;

[0011] Obtaining a training set and a test set for each of the source domains, wherein the training set includes an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on all the original training data sets of the source domains, and the test set includes original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on all the original test data sets of the source domains;

[0012] Performing model training on the initial sub-models based on the training sets respectively to obtain multiple intermediate sub-models;

[0013] Performing model training on the intermediate sub-models based on the test set respectively to obtain a plurality of sub-models that have completed model training;

[0014] All the sub-models that have completed model training are aggregated to obtain an attack category label prediction model that has completed model training.

[0015] Preferably, the performing model training on the initial sub-model based on the training set to obtain the intermediate sub-model specifically includes:

[0016] Based on the initial sub-model, a prediction operation is performed according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain;

[0017] Calculating a first loss function between the first predicted attack category label set and a first real attack category label set corresponding to the source domain original training data set;

[0018] Based on the initial sub-model, a prediction operation is performed according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set;

[0019] Calculating a second loss function between the second predicted attack category label set and a second real attack category label set corresponding to the enhanced training data set;

[0020] Determine the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and update the model parameters of the initial sub-model based on the training loss function to obtain an intermediate sub-model;

[0021] The performing model training on the intermediate sub-model based on the test set to obtain a plurality of sub-models that have completed model training specifically includes:

[0022] Based on the intermediate sub-model, a prediction operation is performed according to the original training data sets of other source domains except the current source domain to obtain a third predicted attack category label set of the original training data sets of other source domains;

[0023] Calculating a third loss function between the third predicted attack category label set and a third real attack category label set corresponding to the other source domain original training data set;

[0024] Based on the intermediate sub-model, a prediction operation is performed according to the enhanced test data set to obtain a fourth predicted attack category label set of the enhanced test data set;

[0025] Calculating a fourth loss function between the fourth predicted attack category label set and a fourth real attack category label set corresponding to the enhanced test data set;

[0026] The sum of the third loss function and the fourth loss function is determined as the test loss function of the intermediate sub-model, and the model parameters of the intermediate sub-model are updated based on the test loss function to obtain a sub-model that has completed model training.

[0027] Preferably, the obtaining of the training set and the test set of the source domain specifically includes:

[0028] Obtaining original source domain data of each source domain, and randomly dividing the original source domain data into an original source domain training data set and an original source domain test data set;

[0029] Extracting first data features of each of the original training data sets in the source domain, performing weighted sum processing on each of the first data features to obtain an enhanced training data set, and aggregating the original training data set in the source domain and the enhanced training data set to obtain a training set in the source domain;

[0030] The second data features of each of the original test data sets in the source domain are extracted, and each of the second data features is weighted and summed to obtain an enhanced test data set, and the original test data set in the source domain and the enhanced test data set are aggregated to obtain a test set of the source domain.

[0031] Preferably, the obtaining of the similarity value between the target network traffic data and the source domain, and the prediction uncertainty value of the predicted attack category label, and calculating the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determining the intrusion detection result of the target network traffic data according to the classification confidence, specifically includes:

[0032] Obtaining a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label;

[0033] Based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated according to the following formula:

[0034]

[0035] Among them, w u (x) represents the classification confidence of the predicted attack category label, d(x) represents the similarity value between the target network traffic data and the source domain, and H(y u ) represents the prediction uncertainty value of the predicted attack category label, logC s | represents the maximum prediction uncertainty of the predicted attack category label;

[0036] If the classification confidence is greater than a preset confidence threshold, determining the intrusion detection result of the target network traffic data as the predicted attack category label;

[0037] If the classification confidence is less than the preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

[0038] Preferably, after obtaining the target network traffic data, the method further includes:

[0039] Extracting data with the same flow granularity from the target network traffic data, and sorting them in chronological order to obtain a data flow;

[0040] extracting features of the data stream;

[0041] Convert the features into binary vectors based on a one-hot encoding method;

[0042] Selecting a first preset number of data packets from the data stream, and selecting a second preset number of bytes from the data packets;

[0043] generating a grayscale image based on the bytes and the binary vector;

[0044] Determining a color channel based on the data packet and the binary vector, and converting the grayscale image into a color image based on the color channel;

[0045] The attack category label prediction model based on the completed model training performs a prediction operation according to the target network traffic data to obtain a predicted attack category label of the target network traffic data, specifically including:

[0046] Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the color image to obtain a predicted attack category label for the target network traffic data.

[0047] Preferably, when the feature of the data stream is a categorical feature, the feature is converted into a binary vector based on a one-hot encoding method;

[0048] When the feature of the data stream is a continuous feature, the feature is converted into a binary vector based on a one-hot encoding method, specifically including:

[0049] Normalizing the continuous features to obtain scaled continuous features;

[0050] The scaled continuous feature is discretized into a plurality of intervals to obtain a discrete form of the continuous feature, and the discrete form of the continuous feature is converted into a binary vector based on a one-hot encoding method.

[0051] According to another aspect of the present application, there is provided an intrusion detection device for an electric power industrial control system, comprising:

[0052] A target network traffic data acquisition module is used to acquire target network traffic data;

[0053] An attack category label prediction module is used to perform a prediction operation according to the target network traffic data based on the attack category label prediction model that has completed model training, and obtain a predicted attack category label of the target network traffic data. The attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on the open domain generalization meta-learning algorithm. The training set consists of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains. The test set consists of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains.

[0054] An intrusion detection result determination module is used to obtain a similarity value between the target network traffic data and the source domain, as well as a prediction uncertainty value of the predicted attack category label, and calculate the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine the intrusion detection result of the target network traffic data according to the classification confidence, and the intrusion detection result is the predicted attack category label or an unknown category label.

[0055] Preferably, before the attack category label prediction module, the device further includes a model training module, specifically including:

[0056] A sub-model construction unit, used to construct an initial sub-model of each of the source domains;

[0057] A training set acquisition unit, used to acquire a training set and a test set of each of the source domains, wherein the training set includes an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all the source domains, and the test set includes an original training data set of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all the source domains;

[0058] A first training unit, configured to perform model training on the initial sub-models based on the training sets to obtain a plurality of intermediate sub-models;

[0059] A second training unit is used to perform model training on the intermediate sub-models based on the test set to obtain multiple sub-models that have completed model training;

[0060] The sub-model aggregation unit is used to aggregate all the sub-models that have completed model training to obtain an attack category label prediction model that has completed model training.

[0061] Preferably, the first training unit is specifically used for:

[0062] Based on the initial sub-model, a prediction operation is performed according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain;

[0063] Calculating a first loss function between the first predicted attack category label set and a first real attack category label set corresponding to the source domain original training data set;

[0064] Based on the initial sub-model, a prediction operation is performed according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set;

[0065] Calculating a second loss function between the second predicted attack category label set and a second real attack category label set corresponding to the enhanced training data set;

[0066] Determine the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and update the model parameters of the initial sub-model based on the training loss function to obtain an intermediate sub-model;

[0067] The second training unit is specifically used for:

[0068] Based on the intermediate sub-model, a prediction operation is performed according to the original training data sets of other source domains except the current source domain to obtain a third predicted attack category label set of the original training data sets of other source domains;

[0069] Calculating a third loss function between the third predicted attack category label set and a third real attack category label set corresponding to the other source domain original training data set;

[0070] Based on the intermediate sub-model, a prediction operation is performed according to the enhanced test data set to obtain a fourth predicted attack category label set of the enhanced test data set;

[0071] Calculating a fourth loss function between the fourth predicted attack category label set and a fourth real attack category label set corresponding to the enhanced test data set;

[0072] The sum of the third loss function and the fourth loss function is determined as the test loss function of the intermediate sub-model, and the model parameters of the intermediate sub-model are updated based on the test loss function to obtain a sub-model that has completed model training.

[0073] Preferably, the training set acquisition unit is specifically used to:

[0074] Obtaining original source domain data of each source domain, and randomly dividing the original source domain data into an original source domain training data set and an original source domain test data set;

[0075] Extracting first data features of each of the original training data sets in the source domain, performing weighted sum processing on each of the first data features to obtain an enhanced training data set, and aggregating the original training data set in the source domain and the enhanced training data set to obtain a training set in the source domain;

[0076] The second data features of each of the original test data sets in the source domain are extracted, and each of the second data features is weighted and summed to obtain an enhanced test data set, and the original test data set in the source domain and the enhanced test data set are aggregated to obtain a test set of the source domain.

[0077] Preferably, the intrusion detection result determination module is specifically used to:

[0078] Obtaining a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label;

[0079] Based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated according to the following formula:

[0080]

[0081] Among them, w u (x) represents the classification confidence of the predicted attack category label, d(x) represents the similarity value between the target network traffic data and the source domain, and H(y u ) represents the prediction uncertainty value of the predicted attack category label, logC s | represents the maximum prediction uncertainty of the predicted attack category label;

[0082] If the classification confidence is greater than a preset confidence threshold, determining the intrusion detection result of the target network traffic data as the predicted attack category label;

[0083] If the classification confidence is less than the preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

[0084] Preferably, after the target network traffic data acquisition module, the device further includes an image conversion module, specifically including:

[0085] A data flow extraction unit, used to extract data with the same flow granularity from the target network flow data, and sort them in chronological order to obtain a data flow;

[0086] A feature extraction unit, used to extract features of the data stream;

[0087] A binary vector conversion unit, configured to convert the feature into a binary vector based on a one-hot encoding method;

[0088] a selection unit, configured to select a first preset number of data packets from the data stream, and a second preset number of bytes from the data packets;

[0089] A grayscale image generating unit, configured to generate a grayscale image based on the byte and the binary vector;

[0090] A color image generating unit, configured to determine a color channel based on the data packet and the binary vector, and convert the grayscale image into a color image based on the color channel;

[0091] The attack category label prediction module is specifically used to:

[0092] Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the color image to obtain a predicted attack category label for the target network traffic data.

[0093] Preferably, the binary vector conversion unit is specifically used for:

[0094] When the feature of the data stream is a categorical feature, converting the feature into a binary vector based on a one-hot encoding method;

[0095] When the feature of the data stream is a continuous feature, normalizing the continuous feature to obtain a scaled continuous feature;

[0096] The scaled continuous feature is discretized into a plurality of intervals to obtain a discrete form of the continuous feature, and the discrete form of the continuous feature is converted into a binary vector based on a one-hot encoding method.

[0097] According to another aspect of the present application, a storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute operations corresponding to the above-mentioned power industrial control system intrusion detection method.

[0098] According to another aspect of the present application, a terminal is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

[0099] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned power industrial control system intrusion detection method.

[0100] By means of the above technical solution, the technical solution provided by the embodiment of the present application has at least the following advantages:

[0101] The present application provides an intrusion detection method and device, medium, and terminal for an electric power industrial control system. First, target network traffic data is acquired; secondly, based on an attack category label prediction model that has completed model training, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label for the target network traffic data, wherein the attack category label prediction model is obtained by model training based on training sets and test sets of each source domain and based on an open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains; finally, a similarity value between the target network traffic data and the source domain, as well as a predicted uncertainty value of the predicted attack category label are acquired, and a classification confidence of the predicted attack category label is calculated based on the similarity value and the predicted uncertainty value, and an intrusion detection result of the target network traffic data is determined according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label. Compared with the prior art, the embodiment of the present application pre-trains the model based on the open domain generalization meta-learning algorithm to obtain the attack category label prediction model. By introducing the open domain scenario, it can not only accurately identify the network traffic data of known categories, but also effectively improve the recognition accuracy of unknown target domain data, thereby improving the generalization of the model prediction. Furthermore, the training data used for model training are the training set and test set of each source domain, wherein the training set is composed of the original training data set of the source domain and the enhanced training data set obtained by data enhancement processing based on the original training data set of all the source domains, and the test set is composed of the original training data set of other source domains except the current source domain and the original training data set of all the source domains. The enhanced test data set is composed of data augmentation processing on the original test data set in the source domain, which can effectively make up for the defect that the target domain data of unknown categories is difficult to obtain, avoid the problem of model overfitting, and improve the generalization of model prediction; finally, by calculating the classification confidence of the predicted attack category label, and determining the predicted attack category label exceeding the threshold as the final intrusion detection result of the target network traffic data, the final intrusion detection result of the target network traffic data that does not exceed the threshold is determined as an unknown category label, which not only ensures the accuracy of the intrusion detection results for the known category network traffic data, but also takes into account the unknown category, thereby improving the overall accuracy of the intrusion detection results.

[0102] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0104] Figure 1 A flow chart of an intrusion detection method for an electric power industrial control system provided by an embodiment of the present application is shown;

[0105] Figure 2 A flow chart of attack category label prediction model training provided by an embodiment of the present application is shown;

[0106] Figure 3 A flowchart for determining an intrusion detection result provided by an embodiment of the present application is shown;

[0107] Figure 4 Another flow chart of an intrusion detection method for an electric power industrial control system provided by an embodiment of the present application is shown;

[0108] Figure 5 A flow chart of binary vector conversion of classified features provided by an embodiment of the present application is shown;

[0109] Figure 6 A flow chart of continuous feature binary vector conversion provided by an embodiment of the present application is shown;

[0110] Figure 7 A block diagram of an intrusion detection device for an electric power industrial control system provided by an embodiment of the present application is shown;

[0111] Figure 8 A schematic diagram of the structure of a terminal provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0112] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0113] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0114] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0115] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0116] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0117] The embodiments of the present application can be applied to computer systems / servers, which can operate with many other general or special computing system environments or configurations. Examples of well-known computing systems, environments and / or configurations suitable for use with computer systems / servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above systems, etc.

[0118] Computer systems / servers may be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. In general, program modules may include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules may be located on local or remote computing system storage media including storage devices.

[0119] The present application embodiment provides a method for detecting intrusion in an electric power industrial control system. Figure 1 As shown, the method includes:

[0120] 101. Obtain target network traffic data.

[0121] The target network traffic data is used to characterize the PCAP data received by the power industrial control system during network communication, for example, communication data from power equipment, communication data from the power industrial control system, etc. In the embodiment of the present application, the current execution end may be a network security protection module of the power industrial control system.

[0122] 102. Based on the attack category label prediction model of the completed model training, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label of the target network traffic data.

[0123] Among them, the attack category label prediction model is obtained by model training based on the open domain generalization meta-learning algorithm according to the training sets and test sets of each source domain; the training set consists of the original training data set of the source domain and the enhanced training data set obtained by data enhancement processing based on the original training data sets of all source domains; the test set consists of the original training data sets of other source domains except the current source domain and the enhanced test data set obtained by data enhancement processing based on the original test data sets of all source domains; the attack category label is used to indicate the attack category of the target network traffic data, for example, non-attack label, category A attack label, category B attack label, etc. In an embodiment of the present application, the attack category label prediction model is composed of a plurality of source domain sub-models, and the source domain sub-models are obtained by training according to the training set and the test set of the source domain respectively. That is, by introducing the open domain scenario, not only the network traffic data of known categories can be accurately identified, but also the recognition accuracy of unknown target domain data can be effectively improved, thereby improving the generalization of the model prediction. Furthermore, the training data used for model training are the training sets and the test sets of each source domain, wherein the training set is composed of the original training data set of the source domain and the enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all the source domains, and the test set is composed of the original training data sets of other source domains except the current source domain and the enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all the source domains, thereby effectively making up for the defect that the target domain data of unknown categories is difficult to obtain, thereby avoiding the problem of overfitting of the model and improving the generalization of the model prediction.

[0124] It should be noted that the source domain sub-model can be established based on any neural network that can achieve classification function, and is not specifically limited in the embodiments of the present application.

[0125] 103. Obtain a similarity value between the target network traffic data and the source domain, as well as a prediction uncertainty value of the predicted attack category label, and calculate the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine the intrusion detection result of the target network traffic data according to the classification confidence.

[0126] Among them, the intrusion detection result is a predicted attack category label or an unknown category label; the similarity value is used to characterize the similarity between the quantified target network traffic data and the source domain; the prediction uncertainty value is used to characterize the prediction uncertainty of the quantified predicted attack category label, which can be expressed based on entropy. Generally, the smaller the entropy, the higher the prediction accuracy; the classification confidence is used to characterize the trustworthiness of the predicted attack category label predicted in step 102 of the embodiment. It should be noted that the intrusion detection result of the target network traffic data can be determined according to the classification confidence threshold method. For example, if it exceeds the threshold, it means that the predicted attack category label predicted in step 102 of the embodiment has a high credibility, and the intrusion detection result can be determined as the predicted attack category label; if it does not exceed the threshold, it means that the predicted attack category label predicted in step 102 of the embodiment has a low credibility, and the intrusion detection result can be determined as an unknown category label. Further, a manual verification prompt message can be issued to prompt manual intervention detection. It not only ensures the accuracy of the intrusion detection results for known category network traffic data, but also takes into account the unknown category, thereby improving the overall accuracy of the intrusion detection results.

[0127] Compared with the prior art, the embodiment of the present application pre-trains the model based on the open domain generalization meta-learning algorithm to obtain the attack category label prediction model. By introducing the open domain scenario, it can not only accurately identify the network traffic data of known categories, but also effectively improve the recognition accuracy of unknown target domain data, thereby improving the generalization of the model prediction. Furthermore, the training data used for model training are the training set and test set of each source domain, wherein the training set is composed of the original training data set of the source domain and the enhanced training data set obtained by data enhancement processing based on the original training data set of all the source domains, and the test set is composed of the original training data set of other source domains except the current source domain and the original training data set of all the source domains. The enhanced test data set is composed of data augmentation processing on the original test data set in the source domain, which can effectively make up for the defect that the target domain data of unknown categories is difficult to obtain, avoid the problem of model overfitting, and improve the generalization of model prediction; finally, by calculating the classification confidence of the predicted attack category label, and determining the predicted attack category label exceeding the threshold as the final intrusion detection result of the target network traffic data, the final intrusion detection result of the target network traffic data that does not exceed the threshold is determined as an unknown category label, which not only ensures the accuracy of the intrusion detection results for the known category network traffic data, but also takes into account the unknown category, thereby improving the overall accuracy of the intrusion detection results.

[0128] In an embodiment of the present application, in order to further define and illustrate, Figure 2As shown, step 102 performs a prediction operation based on the attack category label prediction model for which model training has been completed according to the target network traffic data to obtain the predicted attack category label of the target network traffic data. The embodiment method further includes:

[0129] 201. Construct an initial sub-model for each source domain.

[0130] In the embodiment of the present application, an initial sub-model is constructed for each source domain, and the sub-model needs to be able to realize the label prediction function.

[0131] 202. Obtain training sets and test sets of each source domain.

[0132] Among them, the training set includes the original training data set of the source domain and the enhanced training data set obtained by performing data enhancement processing based on all the original training data sets of the source domain; the test set includes the original training data sets of other source domains except the current source domain and the enhanced test data set obtained by performing data enhancement processing based on all the original test data sets of the source domain. In an embodiment of the present application, first, the original source domain data of each source domain is obtained, which may be historical data. Furthermore, the original source domain data is randomly divided into an original source domain training data set and an original source domain test data set; and the first data feature of the original source domain training data set is extracted based on a neural network, and each first data feature is weighted and summed to obtain an enhanced training data set. Specifically, it can be implemented according to the following formula,

[0133]

[0134] Among them, λ s represents the weight of the source domain s, which follows the multivariate Beta distribution, t s Represents the first data feature of the source domain s, t mul -mix represents enhanced training data. It should be noted that t mul-mix Represents a data pair, that is, a set of data and labels. Finally, the original training data set of the source domain and the enhanced training data set of the source domain are aggregated to obtain the training set of the source domain.

[0135] Similarly, the test set of the source domain is obtained.

[0136] Correspondingly, step 202 of the embodiment specifically includes: obtaining the original source domain data of each source domain, and randomly dividing the original source domain data into a source domain original training data set and a source domain original test data set; extracting the first data features of each source domain original training data set, performing weighted sum processing on each first data feature to obtain an enhanced training data set, and aggregating the source domain original training data set and the enhanced training data set to obtain a training set of the source domain; extracting the second data features of each source domain original test data set, performing weighted sum processing on each second data feature to obtain an enhanced test data set, and aggregating the source domain original test data set and the enhanced test data set to obtain a test set of the source domain.

[0137] 203. Perform model training on the initial sub-models based on the training sets respectively to obtain multiple intermediate sub-models.

[0138] Among them, the intermediate sub-model is used to characterize the model obtained by model training based on the training set.

[0139] Correspondingly, step 203 of the embodiment specifically includes: based on the initial sub-model, performing a prediction operation according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain; calculating a first loss function between the first predicted attack category label set and the first real attack category label set corresponding to the original training data set in the source domain; based on the initial sub-model, performing a prediction operation according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set; calculating a second loss function between the second predicted attack category label set and the second real attack category label set corresponding to the enhanced training data set; determining the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and updating the model parameters of the initial sub-model based on the training loss function to obtain the intermediate sub-model.

[0140] Among them, the first predicted attack category label set is used to characterize the prediction based on the initial sub-model according to the original training data set in the source domain; the first real attack category label set is used to characterize the real labels of the original training data set in the source domain; the first loss function is used to characterize the deviation between the first predicted attack category label set and the first real attack category label set; the second predicted attack category label set is used to characterize the prediction based on the enhanced training data set according to the initial sub-model; the second real attack category label set is used to characterize the real labels of the enhanced training data set; the second loss function is used to characterize the deviation between the second predicted attack category label set and the second real attack category label set. In the embodiment of the present application, the initial sub-model can be trained based on the following loss function,

[0141]

[0142] in, represents the first loss function,

[0143] represents the second loss function.

[0144] Furthermore, according to the formula Update the sub-model parameters, where η represents the step size, represents the updated model parameters, represents the model parameters before updating, Represents the gradient.

[0145] 204. Perform model training on the intermediate sub-models based on the test set respectively to obtain multiple sub-models that have completed model training.

[0146] Among them, the sub-model that has completed model training is used to represent the result obtained by secondary training based on the test set on the basis of the intermediate sub-model.

[0147] Correspondingly, step 204 of the embodiment specifically includes: based on the intermediate sub-model, performing a prediction operation according to the original training data sets of other source domains except the current source domain, and obtaining a third predicted attack category label set of the original training data sets of other source domains; calculating a third loss function between the third predicted attack category label set and the third real attack category label set corresponding to the original training data sets of other source domains; based on the intermediate sub-model, performing a prediction operation according to the enhanced test data set, and obtaining a fourth predicted attack category label set of the enhanced test data set; calculating a fourth loss function between the fourth predicted attack category label set and the fourth real attack category label set corresponding to the enhanced test data set; determining the sum of the third loss function and the fourth loss function as the test loss function of the intermediate sub-model, and updating the model parameters of the intermediate sub-model based on the test loss function to obtain a sub-model that has completed model training.

[0148] Among them, the third predicted attack category label set is used to characterize the prediction based on the intermediate sub-model according to the original training data set of other source domains except the current source domain; the third real attack category label set is used to characterize the real label of the original training data set of other source domains; the third loss function is used to characterize the deviation between the third predicted attack category label set and the third real attack category label set; the fourth predicted attack category label set is used to characterize the prediction based on the intermediate sub-model according to the enhanced test data set; the fourth real attack category label set is used to characterize the real label of the enhanced test data set; the fourth loss function is used to characterize the deviation between the fourth predicted attack category label set and the fourth real attack category label set. In the embodiment of the present application, the intermediate sub-model can be trained based on the following loss function,

[0149]

[0150] in, represents the third loss function,

[0151] Represents the fourth loss function.

[0152] Furthermore, according to the formula Update the sub-model parameters, where β represents the step size, represents the updated model parameters, represents the model parameters before updating, Represents the gradient.

[0153] 205. Aggregate all sub-models that have completed model training to obtain an attack category label prediction model that has completed model training.

[0154] Based on the above steps, each source domain has obtained a sub-model that has completed model training. In the embodiment of the present application, all of them are aggregated to obtain an attack category label prediction model that has completed model training. Further, when performing a prediction operation based on the target network traffic data based on the attack category label prediction model that has completed model training, it is specifically based on the following formula:

[0155]

[0156] Among them, x u Represents the target network traffic data, y u represents the predicted attack category label, M S Represents the sub-model of the completed model training for the source domain S.

[0157] Since the attack category label prediction model aggregates the sub-models of all source domains, when performing prediction operations, not only the prediction confidence is calibrated and the prediction accuracy is improved, but also the recognition accuracy of unknown target domain data can be improved, thereby improving the generalization of model predictions.

[0158] In an embodiment of the present application, in order to further define and illustrate, Figure 3 As shown, step 103 of the embodiment obtains the similarity value between the target network traffic data and the source domain, and the prediction uncertainty value of the predicted attack category label, and calculates the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determines the intrusion detection result of the target network traffic data according to the classification confidence, specifically including:

[0159] 301. Obtain the similarity value between the target network traffic data and the source domain, and the prediction uncertainty value of the predicted attack category label.

[0160] 302. Based on the similarity value and the prediction uncertainty value, calculate the classification confidence of the predicted attack category label.

[0161] 303. If the classification confidence is greater than a preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be a predicted attack category label.

[0162] 304. If the classification confidence is less than a preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

[0163] The similarity value can be quantified based on the domain discriminator; the prediction uncertainty value can be expressed based on entropy. In the embodiment of the present application, the classification confidence of the predicted attack category label is calculated according to the following formula:

[0164]

[0165] Among them, w u (x) represents the classification confidence of the predicted attack category label, d(x) represents the similarity value between the target network traffic data and the source domain, and H(y u ) represents the prediction uncertainty value of the predicted attack category label, logC s | represents the maximum prediction uncertainty of the predicted attack class label.

[0166] Furthermore, the confidence threshold is set in advance. It should be noted that the preset confidence threshold should not be set too high, because if the preset confidence threshold is increased in pursuit of a high recognition rate for unknown classes, it will inevitably lead to a low recognition accuracy rate for other known classes of the model. However, in most cases, known classes occupy the vast majority, so the recognition accuracy rate for known classes will be guaranteed first, but unknown classes will also be taken into account at the same time, and a balance must be achieved between the two. Finally, the intrusion detection result of the target network traffic data is determined based on the preset classification confidence threshold. Specifically, if the classification confidence exceeds the preset confidence threshold, it means that the predicted attack category label has a high credibility, and the intrusion detection result can be determined as the predicted attack category label; if the classification confidence does not exceed the preset confidence threshold, it means that the predicted attack category label has a low credibility, and the intrusion detection result can be determined as an unknown category label. Further, a manual verification prompt message can be issued to prompt manual intervention detection. It not only ensures the accuracy of the intrusion detection results for known category network traffic data, but also takes into account unknown categories, thereby improving the overall accuracy of the intrusion detection results.

[0167] The present application embodiment provides another method for detecting intrusion in an electric power industrial control system. Figure 4 As shown, the method includes:

[0168] 401. Obtain target network traffic data.

[0169] The embodiments of the present application have been described in detail in the foregoing content and will not be repeated here.

[0170] 402. Extract data with the same flow granularity from the target network traffic data, and sort them in chronological order to obtain a data flow.

[0171] The flow granularity is used to characterize the data quintuple, including [source IP, destination IP, source port, destination port, protocol].

[0172] 403. Extract features of the data stream.

[0173] Among them, the characteristics of data flow can be divided into basic characteristics, content characteristics and flow similarity characteristics. Basic characteristics are used to describe the basic information of data flow, which may include duration, protocol used, connection status, etc.; content characteristics are used to describe the content information of data flow, which may include number of bytes, emergency data packets, network services, etc.; flow similarity characteristics may include number of connections, login status, error rate, etc. In general, the flow similarity characteristics of malicious traffic are similar.

[0174] 404. Convert features into binary vectors based on the one-hot encoding method.

[0175] In the embodiment of the present application, the features of the data stream include categorical features and continuous features. For categorical features, the features can be directly converted into binary vectors based on the one-hot encoding method. Specifically, Figure 5 It should be noted that protocol type, network service, connection status, etc. are all classified features.

[0176] For continuous features, we need to normalize the continuous features first to obtain scaled continuous features; then discretize the scaled continuous features into multiple intervals to obtain the discrete form of the continuous features; finally, we convert the discrete form of the continuous features into binary vectors based on the one-hot encoding method. Specifically, Figure 6 As shown, first use the Min-Max normalization method to normalize the data to the range of [0,1], as shown in the following formula:

[0177]

[0178] Among them, x min Represents the minimum value of the continuous feature, x max Represents the maximum value of the continuous feature, x new Represents the scaled continuous feature, in particular, when x min and x max When the same, x new Take 0.

[0179] Furthermore, the scaled continuous features are discretized into 10 intervals of [0,1], namely [0,0.1], (0.1,0.2], (0.2,0.3], (0.3,0.4], ..., (0.9,1.0], to obtain the discrete form of the continuous features. Finally, the intervals are sequentially encoded into 10 binary vectors based on the one-hot encoding method to convert the discrete form of the continuous features into binary vectors.

[0180] 405. Select a first preset number of data packets from the data stream, and select a second preset number of bytes from the data packets.

[0181] Typically, the first preset number M may be an integer multiple of 3; the second preset number N may be a perfect square number.

[0182] 406. Generate a grayscale image based on the bytes and the binary vector.

[0183] In the embodiment of the present application, the first N bytes in each data packet can be arranged as follows: A matrix in which each element is one byte (8 bits), that is, there are 256 possible values, corresponding to 256 grayscales. A grayscale image can be generated based on the 256 grayscales and the binary vector obtained above.

[0184] 407. Determine a color channel based on the data packet and the binary vector, and convert the grayscale image into a color image based on the color channel.

[0185] The first M data packets in the data stream, each group of three, represent the R, G, and B color channels of the color image. The color channels can be determined in combination with the binary vector. Further, the grayscale image in step 406 of the embodiment is converted into a color image based on the color channel, that is, a 24-bit color image.

[0186] Exemplarily, N and M are set to 64 and 9 respectively, so each data packet can form an 8*8 grayscale image, and the entire data stream is converted into 3 color images.

[0187] 408. Based on the attack category label prediction model that has completed model training, a prediction operation is performed according to the color image to obtain a predicted attack category label of the target network traffic data.

[0188] The embodiment of the present application, as a preferred method, converts the target network traffic data into a color image, realizes the feature extraction of massive data, and does not need to formulate complex feature engineering for different network protocols and different attack categories; then based on the attack category label prediction model that has completed model training, the prediction operation is performed according to the color image, which can effectively reduce the computational complexity and improve the intrusion detection speed.

[0189] The present application provides an intrusion detection method for an electric power industrial control system, which first obtains target network traffic data; secondly, based on an attack category label prediction model that has completed model training, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label of the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on a training set and a test set of each source domain and an open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains; finally, a similarity value between the target network traffic data and the source domain, as well as a predicted uncertainty value of the predicted attack category label are obtained, and a classification confidence of the predicted attack category label is calculated based on the similarity value and the predicted uncertainty value, and an intrusion detection result of the target network traffic data is determined according to the classification confidence, and the intrusion detection result is the predicted attack category label or an unknown category label. Compared with the prior art, the embodiment of the present application pre-trains the model based on the open domain generalization meta-learning algorithm to obtain the attack category label prediction model. By introducing the open domain scenario, it can not only accurately identify the network traffic data of known categories, but also effectively improve the recognition accuracy of unknown target domain data, thereby improving the generalization of the model prediction. Furthermore, the training data used for model training are the training set and test set of each source domain, wherein the training set is composed of the original training data set of the source domain and the enhanced training data set obtained by data enhancement processing based on the original training data set of all the source domains, and the test set is composed of the original training data set of other source domains except the current source domain and the original training data set of all the source domains. The enhanced test data set is composed of data augmentation processing on the original test data set in the source domain, which can effectively make up for the defect that the target domain data of unknown categories is difficult to obtain, avoid the problem of model overfitting, and improve the generalization of model prediction; finally, by calculating the classification confidence of the predicted attack category label, and determining the predicted attack category label exceeding the threshold as the final intrusion detection result of the target network traffic data, the final intrusion detection result of the target network traffic data that does not exceed the threshold is determined as an unknown category label, which not only ensures the accuracy of the intrusion detection results for the known category network traffic data, but also takes into account the unknown category, thereby improving the overall accuracy of the intrusion detection results.

[0190] Furthermore, as a response to the above Figure 1 The implementation of the method shown in the embodiment of the present application provides an intrusion detection device for an electric power industrial control system, such as Figure 7 As shown, the device comprises:

[0191] Target network traffic data acquisition module 51, attack category label prediction module 52, intrusion detection result determination module 53.

[0192] The target network flow data acquisition module 51 is used to acquire the target network flow data;

[0193] An attack category label prediction module 52 is used to perform a prediction operation according to the target network traffic data based on the attack category label prediction model that has completed model training, and obtain a predicted attack category label of the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on the open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of an original training data set of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains;

[0194] The intrusion detection result determination module 53 is used to obtain the similarity value between the target network traffic data and the source domain, as well as the prediction uncertainty value of the predicted attack category label, and calculate the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine the intrusion detection result of the target network traffic data according to the classification confidence, and the intrusion detection result is the predicted attack category label or the unknown category label.

[0195] In a specific application scenario, before the attack category label prediction module, the device further includes a model training module, which specifically includes:

[0196] A sub-model construction unit, used to construct an initial sub-model of each of the source domains;

[0197] A training set acquisition unit, used to acquire a training set and a test set of each of the source domains, wherein the training set includes an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all the source domains, and the test set includes an original training data set of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all the source domains;

[0198] A first training unit, configured to perform model training on the initial sub-models based on the training sets to obtain a plurality of intermediate sub-models;

[0199] A second training unit is used to perform model training on the intermediate sub-models based on the test set to obtain multiple sub-models that have completed model training;

[0200] The sub-model aggregation unit is used to aggregate all the sub-models that have completed model training to obtain an attack category label prediction model that has completed model training.

[0201] In a specific application scenario, the first training unit is specifically used to:

[0202] Based on the initial sub-model, a prediction operation is performed according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain;

[0203] Calculating a first loss function between the first predicted attack category label set and a first real attack category label set corresponding to the source domain original training data set;

[0204] Based on the initial sub-model, a prediction operation is performed according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set;

[0205] Calculating a second loss function between the second predicted attack category label set and a second real attack category label set corresponding to the enhanced training data set;

[0206] Determine the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and update the model parameters of the initial sub-model based on the training loss function to obtain an intermediate sub-model;

[0207] The second training unit is specifically used for:

[0208] Based on the intermediate sub-model, a prediction operation is performed according to the original training data sets of other source domains except the current source domain to obtain a third predicted attack category label set of the original training data sets of other source domains;

[0209] Calculating a third loss function between the third predicted attack category label set and a third real attack category label set corresponding to the other source domain original training data set;

[0210] Based on the intermediate sub-model, a prediction operation is performed according to the enhanced test data set to obtain a fourth predicted attack category label set of the enhanced test data set;

[0211] Calculating a fourth loss function between the fourth predicted attack category label set and a fourth real attack category label set corresponding to the enhanced test data set;

[0212] The sum of the third loss function and the fourth loss function is determined as the test loss function of the intermediate sub-model, and the model parameters of the intermediate sub-model are updated based on the test loss function to obtain a sub-model that has completed model training.

[0213] In a specific application scenario, the training set acquisition unit is specifically used to:

[0214] Obtaining original source domain data of each source domain, and randomly dividing the original source domain data into an original source domain training data set and an original source domain test data set;

[0215] Extracting first data features of each of the original training data sets in the source domain, performing weighted sum processing on each of the first data features to obtain an enhanced training data set, and aggregating the original training data set in the source domain and the enhanced training data set to obtain a training set in the source domain;

[0216] The second data features of each of the original test data sets in the source domain are extracted, and each of the second data features is weighted and summed to obtain an enhanced test data set, and the original test data set in the source domain and the enhanced test data set are aggregated to obtain a test set of the source domain.

[0217] In a specific application scenario, the intrusion detection result determination module is specifically used to:

[0218] Obtaining a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label;

[0219] Based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated according to the following formula:

[0220]

[0221] Among them, w u (x) represents the classification confidence of the predicted attack category label, d(x) represents the similarity value between the target network traffic data and the source domain, and H(y u ) represents the prediction uncertainty value of the predicted attack category label, logCs| represents the maximum prediction uncertainty of the predicted attack category label;

[0222] If the classification confidence is greater than a preset confidence threshold, determining the intrusion detection result of the target network traffic data as the predicted attack category label;

[0223] If the classification confidence is less than the preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

[0224] In a specific application scenario, after the target network traffic data acquisition module, the device further includes an image conversion module, which specifically includes:

[0225] A data flow extraction unit, used to extract data with the same flow granularity from the target network flow data, and sort them in chronological order to obtain a data flow;

[0226] A feature extraction unit, used to extract features of the data stream;

[0227] A binary vector conversion unit, used for converting the feature into a binary vector based on a one-hot encoding method;

[0228] a selection unit, configured to select a first preset number of data packets from the data stream, and a second preset number of bytes from the data packets;

[0229] A grayscale image generating unit, configured to generate a grayscale image based on the byte and the binary vector;

[0230] A color image generating unit, configured to determine a color channel based on the data packet and the binary vector, and convert the grayscale image into a color image based on the color channel;

[0231] The attack category label prediction module is specifically used to:

[0232] Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the color image to obtain a predicted attack category label for the target network traffic data.

[0233] In a specific application scenario, the binary vector conversion unit is specifically used to:

[0234] When the feature of the data stream is a categorical feature, converting the feature into a binary vector based on a one-hot encoding method;

[0235] When the feature of the data stream is a continuous feature, normalizing the continuous feature to obtain a scaled continuous feature;

[0236] The scaled continuous feature is discretized into a plurality of intervals to obtain a discrete form of the continuous feature, and the discrete form of the continuous feature is converted into a binary vector based on a one-hot encoding method.

[0237] The present application provides an intrusion detection device for an electric power industrial control system, which first acquires target network traffic data; secondly, based on an attack category label prediction model that has completed model training, performs a prediction operation according to the target network traffic data to obtain a predicted attack category label of the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on a training set and a test set of each source domain and an open domain generalization meta-learning algorithm, wherein the training set consists of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set consists of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains; finally, obtains a similarity value between the target network traffic data and the source domain, and a predicted uncertainty value of the predicted attack category label, and calculates a classification confidence of the predicted attack category label based on the similarity value and the predicted uncertainty value, and determines an intrusion detection result of the target network traffic data according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label. Compared with the prior art, the embodiment of the present application pre-trains the model based on the open domain generalization meta-learning algorithm to obtain the attack category label prediction model. By introducing the open domain scenario, it can not only accurately identify the network traffic data of known categories, but also effectively improve the recognition accuracy of unknown target domain data, thereby improving the generalization of the model prediction. Furthermore, the training data used for model training are the training set and test set of each source domain, wherein the training set is composed of the original training data set of the source domain and the enhanced training data set obtained by data enhancement processing based on the original training data set of all the source domains, and the test set is composed of the original training data set of other source domains except the current source domain and the original training data set of all the source domains. The enhanced test data set is composed of data augmentation processing on the original test data set in the source domain, which can effectively make up for the defect that the target domain data of unknown categories is difficult to obtain, avoid the problem of model overfitting, and improve the generalization of model prediction; finally, by calculating the classification confidence of the predicted attack category label, and determining the predicted attack category label exceeding the threshold as the final intrusion detection result of the target network traffic data, the final intrusion detection result of the target network traffic data that does not exceed the threshold is determined as an unknown category label, which not only ensures the accuracy of the intrusion detection results for the known category network traffic data, but also takes into account the unknown category, thereby improving the overall accuracy of the intrusion detection results.

[0238] According to an embodiment of the present application, a storage medium is provided, wherein the storage medium stores at least one executable instruction, and the computer executable instruction can execute the power industrial control system intrusion detection method in any of the above method embodiments.

[0239] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0240] Figure 8 A schematic diagram of the structure of a terminal provided according to an embodiment of the present application is shown, and the specific embodiment of the present application does not limit the specific implementation of the terminal.

[0241] like Figure 8 As shown, the terminal may include: a processor (processor) 602 , a communication interface (Communications Interface) 604 , a memory (memory) 606 , and a communication bus 608 .

[0242] The processor 602 , the communication interface 604 , and the memory 606 communicate with each other via a communication bus 608 .

[0243] The communication interface 604 is used to communicate with other devices such as clients or other servers.

[0244] The processor 602 is used to execute the program 610, and specifically can execute the relevant steps in the above-mentioned embodiment of the intrusion detection method for the power industrial control system.

[0245] Specifically, the program 610 may include program codes, which include computer operation instructions.

[0246] The processor 602 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the computer device may be processors of the same type, such as one or more CPUs; or may be processors of different types, such as one or more CPUs and one or more ASICs.

[0247] The memory 606 is used to store the program 610. The memory 606 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0248] The program 610 may be specifically configured to enable the processor 602 to perform the following operations:

[0249] Obtain target network traffic data;

[0250] Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label for the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on an open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains;

[0251] Obtain a similarity value between the target network traffic data and the source domain, as well as a prediction uncertainty value of the predicted attack category label, and calculate the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine the intrusion detection result of the target network traffic data according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label.

[0252] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the physical device of the above-mentioned power industrial control system intrusion detection method, and supports the operation of information processing programs and other software and / or programs. The network communication module is used to realize communication between components inside the storage medium, and communication with other hardware and software in the information processing physical device.

[0253] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0254] The method and system of the present application may be implemented in many ways. For example, the method and system of the present application may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present application are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present application may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present application. Therefore, the present application also covers a recording medium storing a program for executing the method according to the present application.

[0255] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0256] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting intrusion in an electric power industrial control system, characterized in that: include: Obtain target network traffic data; Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the target network traffic data to obtain a predicted attack category label for the target network traffic data, wherein the attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on an open domain generalization meta-learning algorithm, wherein the training set is composed of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains, and the test set is composed of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains; Obtaining a similarity value between the target network traffic data and the source domain, and a prediction uncertainty value of the predicted attack category label, and calculating a classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determining an intrusion detection result of the target network traffic data according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label; Before the attack category label prediction model based on the completed model training performs a prediction operation according to the target network traffic data to obtain the predicted attack category label of the target network traffic data, the method further includes: constructing initial sub-models of each of the source domains; Obtaining a training set and a test set for each of the source domains, wherein the training set includes an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on all the original training data sets of the source domains, and the test set includes original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on all the original test data sets of the source domains; Performing model training on the initial sub-models based on the training sets respectively to obtain multiple intermediate sub-models; Performing model training on the intermediate sub-models based on the test set respectively to obtain a plurality of sub-models that have completed model training; Aggregate all the sub-models that have completed model training to obtain an attack category label prediction model that has completed model training; The performing model training on the initial sub-model based on the training set to obtain the intermediate sub-model specifically includes: Based on the initial sub-model, a prediction operation is performed according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain; Calculating a first loss function between the first predicted attack category label set and a first real attack category label set corresponding to the source domain original training data set; Based on the initial sub-model, a prediction operation is performed according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set; Calculating a second loss function between the second predicted attack category label set and a second real attack category label set corresponding to the enhanced training data set; Determine the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and update the model parameters of the initial sub-model based on the training loss function to obtain an intermediate sub-model; The performing model training on the intermediate sub-model based on the test set to obtain a plurality of sub-models that have completed model training specifically includes: Based on the intermediate sub-model, a prediction operation is performed according to the original training data sets of other source domains except the current source domain to obtain a third predicted attack category label set of the original training data sets of other source domains; Calculating a third loss function between the third predicted attack category label set and a third real attack category label set corresponding to the other source domain original training data set; Based on the intermediate sub-model, a prediction operation is performed according to the enhanced test data set to obtain a fourth predicted attack category label set of the enhanced test data set; Calculating a fourth loss function between the fourth predicted attack category label set and a fourth real attack category label set corresponding to the enhanced test data set; Determine the sum of the third loss function and the fourth loss function as the test loss function of the intermediate sub-model, and update the model parameters of the intermediate sub-model based on the test loss function to obtain a sub-model that has completed model training; The obtaining of the similarity value between the target network traffic data and the source domain, and the prediction uncertainty value of the predicted attack category label, and calculating the classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determining the intrusion detection result of the target network traffic data according to the classification confidence, specifically includes: Obtaining a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label; Based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated according to the following formula: in, represents the classification confidence of the predicted attack category label, Represents the similarity value between the target network traffic data and the source domain, represents the prediction uncertainty value of the predicted attack category label, represents the maximum prediction uncertainty of the predicted attack category label, Represents the predicted attack category label; If the classification confidence is greater than a preset confidence threshold, determining the intrusion detection result of the target network traffic data as the predicted attack category label; If the classification confidence is less than the preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

2. The method according to claim 1, characterized in that The obtaining of the training set and the test set of the source domain specifically includes: Obtaining original source domain data of each source domain, and randomly dividing the original source domain data into an original source domain training data set and an original source domain test data set; Extracting first data features of each of the original training data sets in the source domain, performing weighted sum processing on each of the first data features to obtain an enhanced training data set, and aggregating the original training data set in the source domain and the enhanced training data set to obtain a training set in the source domain; The second data features of each of the original test data sets in the source domain are extracted, and each of the second data features is weighted and summed to obtain an enhanced test data set, and the original test data set in the source domain and the enhanced test data set are aggregated to obtain a test set of the source domain.

3. The method according to claim 1, characterized in that After acquiring the target network traffic data, the method further includes: Extracting data with the same flow granularity from the target network traffic data, and sorting them in chronological order to obtain a data flow; extracting features of the data stream; Convert the features into binary vectors based on a one-hot encoding method; Selecting a first preset number of data packets from the data stream, and selecting a second preset number of bytes from the data packets; generating a grayscale image based on the bytes and the binary vector; Determining a color channel based on the data packet and the binary vector, and converting the grayscale image into a color image based on the color channel; The attack category label prediction model based on the completed model training performs a prediction operation according to the target network traffic data to obtain the predicted attack category label of the target network traffic data, specifically including: Based on the attack category label prediction model for which model training has been completed, a prediction operation is performed according to the color image to obtain a predicted attack category label for the target network traffic data.

4. The method according to claim 3, characterized in that When the feature of the data stream is a categorical feature, converting the feature into a binary vector based on a one-hot encoding method; When the feature of the data stream is a continuous feature, the feature is converted into a binary vector based on a one-hot encoding method, specifically including: Normalizing the continuous features to obtain scaled continuous features; The scaled continuous feature is discretized into a plurality of intervals to obtain a discrete form of the continuous feature, and the discrete form of the continuous feature is converted into a binary vector based on a one-hot encoding method.

5. An intrusion detection device for an electric power industrial control system, characterized in that: include: A target network traffic data acquisition module is used to acquire target network traffic data; An attack category label prediction module is used to perform a prediction operation according to the target network traffic data based on the attack category label prediction model that has completed model training, and obtain a predicted attack category label of the target network traffic data. The attack category label prediction model is obtained by performing model training based on the training set and test set of each source domain and based on the open domain generalization meta-learning algorithm. The training set consists of an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all source domains. The test set consists of original training data sets of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all source domains. an intrusion detection result determination module, used to obtain a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label, and calculate a classification confidence of the predicted attack category label based on the similarity value and the prediction uncertainty value, and determine an intrusion detection result of the target network traffic data according to the classification confidence, wherein the intrusion detection result is the predicted attack category label or an unknown category label; Before the attack category label prediction module, the device also includes a model training module, which specifically includes: A sub-model construction unit, used to construct an initial sub-model of each of the source domains; A training set acquisition unit, used to acquire a training set and a test set of each of the source domains, wherein the training set includes an original training data set of the source domain and an enhanced training data set obtained by performing data enhancement processing based on the original training data sets of all the source domains, and the test set includes an original training data set of other source domains except the current source domain and an enhanced test data set obtained by performing data enhancement processing based on the original test data sets of all the source domains; A first training unit, configured to perform model training on the initial sub-models based on the training sets to obtain a plurality of intermediate sub-models; A second training unit is used to perform model training on the intermediate sub-models based on the test set to obtain multiple sub-models that have completed model training; A sub-model aggregation unit, used to aggregate all the sub-models that have completed model training to obtain an attack category label prediction model that has completed model training; The first training unit is specifically used for: Based on the initial sub-model, a prediction operation is performed according to the original training data set in the source domain to obtain a first predicted attack category label set of the original training data set in the source domain; Calculating a first loss function between the first predicted attack category label set and a first real attack category label set corresponding to the source domain original training data set; Based on the initial sub-model, a prediction operation is performed according to the enhanced training data set to obtain a second predicted attack category label set of the enhanced training data set; Calculating a second loss function between the second predicted attack category label set and a second real attack category label set corresponding to the enhanced training data set; Determine the sum of the first loss function and the second loss function as the training loss function of the initial sub-model, and update the model parameters of the initial sub-model based on the training loss function to obtain an intermediate sub-model; The second training unit is specifically used for: Based on the intermediate sub-model, a prediction operation is performed according to the original training data sets of other source domains except the current source domain to obtain a third predicted attack category label set of the original training data sets of other source domains; Calculating a third loss function between the third predicted attack category label set and a third real attack category label set corresponding to the other source domain original training data set; Based on the intermediate sub-model, a prediction operation is performed according to the enhanced test data set to obtain a fourth predicted attack category label set of the enhanced test data set; Calculating a fourth loss function between the fourth predicted attack category label set and a fourth real attack category label set corresponding to the enhanced test data set; Determine the sum of the third loss function and the fourth loss function as the test loss function of the intermediate sub-model, and update the model parameters of the intermediate sub-model based on the test loss function to obtain a sub-model that has completed model training; The intrusion detection result determination module is specifically used to: Obtaining a similarity value between the target network traffic data and a source domain, and a prediction uncertainty value of the predicted attack category label; Based on the similarity value and the prediction uncertainty value, the classification confidence of the predicted attack category label is calculated according to the following formula: in, represents the classification confidence of the predicted attack category label, Represents the similarity value between the target network traffic data and the source domain, represents the prediction uncertainty value of the predicted attack category label, represents the maximum prediction uncertainty of the predicted attack category label, Represents the predicted attack category label; If the classification confidence is greater than a preset confidence threshold, determining the intrusion detection result of the target network traffic data as the predicted attack category label; If the classification confidence is less than the preset confidence threshold, the intrusion detection result of the target network traffic data is determined to be an unknown category label.

6. A storage medium, wherein at least one executable instruction is stored in the storage medium, characterized in that: The executable instructions enable the processor to execute operations corresponding to the power industrial control system intrusion detection method according to any one of claims 1 to 4.

7. A terminal, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, wherein the executable instruction enables the processor to perform operations corresponding to the power industrial control system intrusion detection method according to any one of claims 1-4.

Images