A method for identifying and detecting threat source behaviors of power near-field networks and edge devices

Abstract

The present invention discloses a method for identifying and detecting threat source behaviors of power near-field network and edge devices, which belongs to the field of power system security technology. The method comprises: collecting data from power near-field network devices and edge devices based on characteristic indicators of multiple characteristic types, obtaining original characteristic data sets containing characteristic data of multiple data types and characteristic data time series; preprocessing the original characteristic data sets to obtain a unified time series statistical characteristic data set; extracting statistical features of the unified time series statistical characteristic data set, and obtaining the most important characteristic data set according to the statistical features; generating threat detection results using a machine learning algorithm according to the most important characteristic data set, and obtaining a threat report according to the threat detection results. The method can improve the accuracy of threat source detection and the efficiency of threat identification.

Description

Technical Field

[0001] The present invention belongs to the field of power system security technology, and specifically relates to a method for identifying and detecting behavior of threat sources of power near-field networks and edge devices. Background Art

[0002] With the development of new power systems, the popularization of distributed energy, electric vehicle charging facilities, smart power terminals and the application of smart distribution network technology, the structure and operation mode of the power grid have undergone profound changes. Power near-field network technology is widely used in power systems, and a large number of edge devices are connected. While these technologies and devices improve the efficiency of power grid operation, optimize resource allocation and enhance power supply reliability, they also bring complex security threats. Power near-field network technology mainly includes the widespread application of wireless communication technology (WIFI / WAPI, low-power wireless LoRa, micro-power wireless RF) and wired communication technology (HPLC, RS232 / 485). Power near-field network technology is used for data exchange and information transmission between power smart terminal devices and sensors. Due to the diversity of application scenarios and requirements, these technologies vary in protocols, frequency bands, authentication methods and encryption methods, and face their own security threats, such as firmware vulnerabilities, insecure communication protocols, improper configuration, etc., which will lead to man-in-the-middle attacks, malware, DDoS and other attack threats, affecting the safe operation of the power system.

[0003] Edge devices are connected through power near-field network technology to achieve real-time data collection and control. Due to the large number of these devices, their wide distribution, and the highly customized device types and configurations, the management and security protection of power near-field networks and edge devices are more difficult. At present, the threat detection methods for power near-field networks and edge devices mainly rely on single features, such as communication protocol data or device operation data, which cannot fully capture complex threat behaviors, resulting in low detection accuracy and high missed and false alarm rates. Existing threat management methods only focus on the current threat status, cannot monitor the dynamic evolution trend of risks, and are difficult to warn and take measures in time. In addition, existing threat reports are usually static and fixed, and cannot be flexibly adjusted according to different business scenarios and security requirements, making it difficult for managers to make the best decision based on actual conditions. The correlation between feature data and risk types is weak, which affects the efficiency and accuracy of actual threat responses.

[0004] Therefore, there is an urgent need for a threat source behavior identification and detection method that can efficiently process comprehensive data of power near-field networks and edge devices, which can not only accurately identify current risks but also infer risk evolution trends. Summary of the invention

[0005] The purpose of the present invention is to provide a method for identifying and detecting threat source behaviors of power near-field networks and edge devices, which can improve the accuracy of threat source detection and the efficiency of threat identification.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for identifying and detecting behavior of threat sources of power near-field networks and edge devices, comprising:

[0008] Based on the characteristic indicators of multiple characteristic types, data is collected from the power near-field network equipment and edge devices to obtain the original characteristic data set containing characteristic data of multiple data types and characteristic data time series;

[0009] Preprocessing the original feature data set to obtain a unified time series statistical feature data set;

[0010] Extracting statistical features of the unified time series statistical feature data set, and obtaining the most important feature data set according to the statistical features;

[0011] Based on the most important feature data set, a threat detection result is generated using a machine learning algorithm, and a threat report is obtained based on the threat detection result.

[0012] In combination with the first aspect, further, preprocessing the original feature data set includes: using different normalization methods to process feature data of different data types in the original feature data set to obtain the unified time series statistical feature data set.

[0013] In combination with the first aspect, further, the data type of the feature data includes numerical data and / or character data.

[0014] In combination with the first aspect, further, the numerical data is directly processed by the Min-Max normalization method; the character data is converted into numerical data by one-hot encoding, and the numerical data is processed by the Min-Max normalization method to obtain a unified time series statistical feature data set.

[0015] In combination with the first aspect, further, the data collection is carried out based on characteristic indicators of multiple characteristic types of comprehensive power near-field networks and edge devices, the numerical data includes signal strength, and / or data packet size, and / or transmission rate, and the character data includes authentication method, and / or encryption protocol.

[0016] In combination with the first aspect, further, extracting statistical features of the unified time series statistical feature data set includes: using an algorithm to extract statistical features of the unified time series statistical feature data set to form a statistical feature sequence, wherein the statistical features include at least one or more combinations of mean, standard deviation, maximum value, and minimum value.

[0017] In combination with the first aspect, further, the algorithm includes a sliding window algorithm.

[0018] In combination with the first aspect, further, obtaining the most important feature data set according to the statistical features includes: selecting the most important features from the statistical feature sequence, and sorting the most important features by feature importance to obtain the most important feature data set.

[0019] In combination with the first aspect, further, selecting the most important feature from the statistical feature sequence includes: using a recursive feature elimination method to obtain the most important feature from the statistical feature sequence;

[0020] Sorting the most important features by feature importance includes: using a tree-based feature selection method to sort the most important features by feature importance.

[0021] In combination with the first aspect, further, using a machine learning algorithm to generate threat detection results includes: inputting the most important feature data set into a multimodal deep neural network Multimodal DNN model, using a one-dimensional convolutional neural network Conv1D in the multimodal deep neural network Multimodal DNN model to extract spatial features of each feature data in the most important feature data set, using a long short-term memory network LSTM in the multimodal deep neural network Multimodal DNN model to capture time series features, and based on the spatial features and time series features of each feature data in the most important feature data set, generating threat detection results through a fully connected layer and an activation function.

[0022] In combination with the first aspect, further, the threat detection result includes classification probabilities of normal behavior and abnormal behavior.

[0023] In combination with the first aspect, further, a threshold for abnormal behavior alarm is set, and when the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs, and an alarm is displayed in the threat report.

[0024] In combination with the first aspect, further, the threshold of the abnormal behavior alarm is a variable parameter and is adjusted according to actual needs.

[0025] In combination with the first aspect, further, the threat report obtained according to the threat detection result includes: according to the threat detection result, using the risk evolution function, obtaining the risk evolution trend.

[0026] In a second aspect, the present invention provides a power near-field network and edge device threat source behavior identification and detection system, the system comprising:

[0027] A data collection module is used to collect data based on feature indicators of multiple feature types, and obtain original feature data sets containing feature data of multiple data types and feature data time series;

[0028] A data preprocessing module is used to preprocess the original feature data set to obtain a unified time series statistical feature data set;

[0029] A feature data processing module, used to extract statistical features of the unified time series statistical feature data set, and obtain the most important feature data set according to the statistical features;

[0030] A threat report generation module is used to generate a threat detection result based on the most important feature data set using a machine learning algorithm, and obtain a threat report based on the threat detection result.

[0031] In combination with the second aspect, further, preprocessing the original feature data set includes: using different normalization methods to process feature data of different data types in the original feature data set to obtain the unified time series statistical feature data set.

[0032] In combination with the second aspect, further, the data type of the feature data includes numerical data and / or character data.

[0033] In combination with the second aspect, further, the numerical data is directly processed by the Min-Max normalization method; the character data is converted into numerical data by one-hot encoding, and the numerical data is processed by the Min-Max normalization method to obtain a unified time series statistical feature data set.

[0034] In combination with the second aspect, further, the data collection is carried out based on characteristic indicators of multiple characteristic types of comprehensive power near-field networks and edge devices, the numerical data includes signal strength, and / or data packet size, and / or transmission rate, and the character data includes authentication method, and / or encryption protocol.

[0035] In combination with the second aspect, further, extracting statistical features of the unified time series statistical feature data set includes: using an algorithm to extract statistical features of the unified time series statistical feature data set to form a statistical feature sequence, wherein the statistical features include at least one or more combinations of mean, standard deviation, maximum value, and minimum value.

[0036] In combination with the second aspect, further, the algorithm includes a sliding window algorithm.

[0037] In combination with the second aspect, further, obtaining the most important feature data set according to the statistical features includes: selecting the most important features from the statistical feature sequence, and sorting the most important features by feature importance to obtain the most important feature data set.

[0038] In conjunction with the second aspect, further, selecting the most important feature from the statistical feature sequence includes: using a recursive feature elimination method to obtain the most important feature from the statistical feature sequence;

[0039] Sorting the most important features by feature importance includes: using a tree-based feature selection method to sort the most important features by feature importance.

[0040] In combination with the second aspect, further, using a machine learning algorithm to generate threat detection results includes: inputting the most important feature data set into a multimodal deep neural network Multimodal DNN model, using a one-dimensional convolutional neural network Conv1D in the multimodal deep neural network Multimodal DNN model to extract the spatial features of each feature data in the most important feature data set, using a long short-term memory network LSTM in the multimodal deep neural network Multimodal DNN model to capture the time series features of each feature data in the most important feature data set, and based on the spatial features and time series features of each feature data in the most important feature data set, generating threat detection results through a fully connected layer and an activation function.

[0041] In combination with the second aspect, further, the threat detection result includes classification probabilities of normal behavior and abnormal behavior.

[0042] In combination with the second aspect, further, a threshold for abnormal behavior alarm is set. When the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs in the power near-field network device and the edge device, and an alarm is displayed in the threat report.

[0043] In combination with the second aspect, further, the threshold of the abnormal behavior alarm is a variable parameter and is adjusted according to actual needs.

[0044] In combination with the second aspect, further, the threat report obtained according to the threat detection result includes: according to the threat detection result, using the risk evolution function, obtaining the risk evolution trend.

[0045] In a third aspect, the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices as described in any one of the first aspects.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices as described in any one of the first aspects.

[0047] Fifthly, the present invention provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices as described in any one of the first aspects.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] The method for identifying and detecting the behavior of threat sources in power near-field networks and edge devices provided by the present invention is based on multi-type data collection and preprocessing, and uses machine learning algorithms to generate threat detection results, and then obtains threat reports, which can improve the accuracy of threat source detection and the efficiency of identifying threats. Different normalization preprocessing is performed on feature data and feature data time series of various data types, which can achieve fast and efficient normalization of various types of data. By extracting and organizing statistical features, the efficiency of training and application of deep neural network models is improved. In the application process, the threshold of abnormal behavior alarm can be adjusted according to actual needs, which can further improve the flexibility and accuracy of the method and system. By combining threat detection results with historical data, the risk evolution trend can be deduced, and the management level of behavior identification and detection of threat sources in power near-field networks and edge devices can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the main process of the method for identifying and detecting the behavior of threat sources of power near-field networks and edge devices provided in an embodiment of the present application;

[0051] Figure 2 It is a detailed flow chart of the method for identifying and detecting the behavior of threat sources of power near-field networks and edge devices provided in an embodiment of the present application;

[0052] Figure 3 It is a schematic diagram of a power near-field network and edge device threat source behavior identification and detection system provided in an embodiment of the present application;

[0053] Figure 4It is a schematic diagram of a computer device that applies the power near-field network and edge device threat source behavior identification and detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The technical solution of the present application is further described in detail below in conjunction with specific implementation methods.

[0055] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and should not be construed as limitations on the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

[0056] An embodiment of the present application provides a method for identifying and detecting the behavior of threat sources in a near-field power network and edge devices. The method for identifying and detecting the behavior of threat sources in a near-field power network and edge devices provided in this embodiment can be applied to a terminal and can be executed by a near-field power network and edge device threat source behavior identification and detection system. The system can be implemented by software and / or hardware. The system can be integrated in a terminal, for example: any tablet computer or computer device with communication function.

[0057] Figure 1 This is a flow chart of a method for identifying and detecting threat sources of power near-field networks and edge devices provided in this embodiment. This flow chart only shows the logical sequence of the method in this embodiment. Different methods can be used without conflict. Figure 1 The steps shown or described are accomplished in the order shown.

[0058] See also Figure 1 The method for identifying and detecting the behavior of threat sources of power near-field networks and edge devices provided in this embodiment specifically includes the following steps:

[0059] S1. Collect data from power near-field network devices and edge devices based on feature indicators of multiple feature types to obtain original feature data sets containing feature data of multiple data types and feature data time series;

[0060] S2, preprocessing the original feature data set to obtain a unified time series statistical feature data set;

[0061] S3, extracting statistical features of a unified time series statistical feature data set, and obtaining the most important feature data set based on the statistical features;

[0062] S4. Based on the most important feature data set, use the machine learning algorithm to generate threat detection results, and obtain a threat report based on the threat detection results.

[0063] Combination Figure 2 Explain each step:

[0064] S1. Data is collected from power near-field network devices and edge devices based on feature indicators of multiple feature types to obtain original feature data sets containing feature data of multiple data types and feature data time series:

[0065] The data collection of this embodiment is based on the comprehensive power near-field network and the characteristic indicators of multiple characteristic types of edge devices. The following describes the data collected by the power near-field network environment and the edge devices to illustrate the characteristic indicators of multiple characteristic types collected by this embodiment.

[0066] 1. Electric near field

[0067] There are many types of equipment in the real-time near-field power network environment. When collecting data on site, six types of data are mainly collected, including connection behavior feature data, communication behavior feature data, authentication and encryption feature data, energy consumption feature data, abnormal behavior feature data, and communication module firmware data. Obtain feature type, feature index, feature data containing at least one of numeric or character type, and time series of feature data. The following is an explanation of the feature indexes of these six types of data:

[0068] 1. Connection behavior feature type data, including feature indicators as follows:

[0069] SSID and BSSID: Indicates the name of the connected network and the MAC address of the access point. The data can help identify the type and location of the network to which the device is connected. Both data types are string types.

[0070] Connection frequency: indicates the frequency with which the device connects to different SSIDs. Frequent network switching may indicate that the device is being interfered with or attacked. The data type is a numeric value.

[0071] Signal strength (RSSI): reflects the distance between the device and the access point. Abnormal changes in signal strength may be a sign of interference or attack. The data type is a numeric type.

[0072] 2. Communication behavior characteristic type data, including characteristic indicators as follows:

[0073] Packet size: The size distribution of sent and received packets. Abnormally large packets may indicate data leakage or attack behavior. The data type is a numeric type.

[0074] Transmission rate: The transmission rate of uplink and downlink. Sudden changes in the rate may be a sign of an attack. The data type is a numeric type.

[0075] Communication protocol: The type of communication protocol used (such as DL / T698, DL / T645, State Grid 1376.2 concentrator local communication interface protocol, State Grid power transmission and transformation equipment Internet of Things micro-power wireless network communication protocol, power transmission and transformation equipment Internet of Things node equipment wireless networking protocol, etc.). Insecure protocols are more likely to lead to network attacks. The data type is string type.

[0076] 3. Authentication and encryption of feature type data, including feature indicators as follows:

[0077] Authentication method: Different authentication methods such as WEP, WPA, WPA2, and WPA3. Weaker authentication methods may be vulnerable to attacks. The data type is a string type.

[0078] Encryption protocol: usage of encryption algorithms such as TKIP and AES. Insecure or outdated encryption algorithms may lead to data leakage. The data type is string type.

[0079] Authentication frequency: The frequency and number of failures of device authentication. Frequent authentication failures may indicate an attack attempt. The data type is a numeric type.

[0080] 4. Energy consumption characteristic data, including characteristic indicators as follows:

[0081] Battery level: The battery level and consumption rate of the device. Abnormal battery consumption may be the result of malware or attacks. The data type is a numeric type.

[0082] Energy consumption mode: The energy consumption mode used by the device (such as BLE connection mode and non-connection mode). Abnormal energy consumption mode conversion may be a sign of attack. The data type is string type.

[0083] 5. Abnormal behavior feature type data, including feature indicators as follows:

[0084] Authentication failure: Multiple authentication failures. Frequent failed attempts may indicate an attack. The data type is a numeric type.

[0085] Abnormal disconnection: The connection is disconnected under abnormal circumstances. Frequent abnormal disconnections may be a sign of an attack. The data type is a numeric type.

[0086] Traffic anomaly: Traffic surges or drops suddenly. Abnormal traffic may indicate data leakage or attack. The data type is numeric.

[0087] 6. Communication module firmware feature type data, including feature indicators as follows:

[0088] Firmware version: The firmware version used by the current module hardware. Old firmware versions may have security vulnerabilities. String type.

[0089] Update record: the history of firmware updates, whether the software problem has been fixed, the data type is string type.

[0090] 2. Edge Equipment

[0091] There are many types of edge devices in the power industry. During on-site data collection, three types of data are collected in real time from edge devices. The three types of data include downlink communication data, internal firmware data, and security assessment data. Obtain feature types, feature indicators, feature data containing at least one of numeric or character types, and time series of feature data. The following is an explanation of the feature indicators of these three types of data:

[0092] 1. Downlink communication feature type data, including feature indicators as follows:

[0093] Connection frequency: The network frequency at which the edge device works. Abnormal frequency changes may be the result of interference or attack. The data type is a numeric type.

[0094] Signal strength: The strength of the signal sent by the edge device. Abnormal changes in signal strength may indicate an attack. The data type is a numeric type.

[0095] Packet size: The size of each packet used in communication between the edge device and the downstream near-field network and the upstream platform. An abnormal packet size may be a sign of an attack. The data type is a numeric type.

[0096] Transmission rate: The upstream and downstream transmission rates of edge devices. Abnormal rate changes may be a sign of attack. The data type is a numeric type.

[0097] Authentication failure rate: The number of times the downstream device fails to perform authentication. Frequent failures may indicate an attack. The data type is a numeric type.

[0098] Traffic anomalies: packet loss rate, traffic surge or sudden drop. Abnormal traffic may be a sign of data leakage or attack. The data type is numeric.

[0099] 2. Internal firmware feature type data, including feature indicators as follows:

[0100] OS system version: The OS system version of the edge device. Outdated or vulnerable system versions may be vulnerable to attacks.

[0101] Container image version: The container image version of the edge device. Frequent or unauthorized image version updates may be a sign of an attack. The data type is a numeric type.

[0102] APP version and list: The APP version and APP list in the container of the edge device. Abnormal APP updates or APPs from unknown sources may indicate an attack.

[0103] Uplink communication protocol: The edge device uploads the platform communication protocol usage. Insecure or abnormal communication protocol usage may be a sign of an attack.

[0104] 3. Safety assessment feature type data, including feature indicators as follows:

[0105] Compliance assessment: historical security compliance assessment results. Poor compliance assessment results may indicate that the system is vulnerable to attacks. The data type is string type.

[0106] Penetration test: historical security penetration test results. Vulnerabilities found in penetration tests need to be fixed in a timely manner, otherwise the system will be vulnerable to attacks. The data type is string type.

[0107] Security Audit: Historical security audit results. Risks found in security audits need to be dealt with in a timely manner, otherwise they may become an entry point for attacks. The data type is string type.

[0108] S2. Preprocess the original feature data set to obtain a unified time series statistical feature data set:

[0109] It can be seen from S1 that the various data collected on-site in real time cover a very wide range. Therefore, in order to ensure the adaptability of this method, these data need to be preprocessed. The preprocessing needs to meet the normalization conditions of the system and have a high execution speed. Therefore, this embodiment uses different normalization methods to process the feature data of different data types in the original feature data set to obtain a unified time series statistical feature data set. Comprehensively analyzing the data types collected in S1, it can be seen that the data types of the feature data collected on-site mainly include numerical data and / or character data. Numerical data include: signal strength, and / or data packet size, and / or transmission rate, and character data include: authentication method, and / or encryption protocol.

[0110] Specifically, for the numerical data in the data set (such as signal strength, data packet size, transmission rate, etc.), the Min-Max normalization method is directly used for processing, and for the character data in the data set (such as authentication method, encryption protocol, etc.), it is converted into numerical data using One-Hot Encoding, and then processed using the Min-Max normalization method to obtain a unified time series statistical feature data set, including:

[0111] 1. For the numerical data in the data set (such as signal strength, data packet size, transmission rate, etc.), the Min-Max normalization method is used to process the data, scale the data to the [0,1] interval, and finally obtain a unified time series statistical feature data set.

[0112] For example, for signal strength (RSSI) data, assuming that the original data is [-80, -70, -60, -50, -40] dBm, the normalized data is [0, 0.25, 0.5, 0.75, 1], and finally a unified time series statistical feature data set is obtained.

[0113] 2. For character data in the data set (such as authentication methods, encryption protocols, etc.), use One-Hot Encoding to convert them into numerical data, and then use the Min-Max normalization method to process them. One-Hot Encoding maps each category to an independent binary vector, and finally obtains a unified time series statistical feature data set. For example, the authentication methods include "WEP", "WPA", "WPA2", and "WPA3". The data after One-Hot Encoding is:

[0114] WEP: [1,0,0,0];

[0115] WPA: [0,1,0,0];

[0116] WPA2: 0,0,1,0];

[0117] WPA3: [0,0,0,1];

[0118] The one-hot encoded data is then subjected to Min-Max normalization processing to obtain a unified time series statistical feature data set.

[0119] Through the above different normalization methods for data of different data types, the various field data collected from the power near-field network and edge equipment can be efficiently normalized to obtain a unified time series statistical feature data set, making the entire threat behavior identification and detection method and system have excellent data compatibility and scalability.

[0120] S3. Extract the statistical features of the unified time series statistical feature data set, and obtain the most important feature data set based on the statistical features:

[0121] In order to generate high-quality feature sequences and provide effective data input for subsequent feature selection and model training, thereby improving the processing efficiency of machine learning and the accuracy of results, this embodiment uses an algorithm to extract the statistical features of a unified time series statistical feature data set, and obtains the most important feature data set based on the statistical features.

[0122] The most important feature data set of this embodiment is completed by at least two steps, namely, forming a statistical feature sequence and obtaining the most important feature data set. The specific operation process is as follows:

[0123] S31, forming a statistical feature sequence:

[0124] In step S31, a sliding window algorithm is used to extract the statistical features of a unified time series statistical feature data set to generate a high-quality feature sequence, providing data input for subsequent feature selection and model training, including the mean, standard deviation, maximum value, and minimum value. By setting a window of a fixed size, it slides on the time series data, moving one step at a time, and extracting the statistical features of the data within the window.

[0125] The mean of the data is calculated. In each sliding window, the data is slid on the time series data, one step at a time, to extract the statistical features of the data in the window. The mean of the data is calculated. In each sliding window:

[0126] ;

[0127] in, is the data point in the window, is the window size.

[0128] Calculate the standard deviation of the data:

[0129] ;

[0130] Calculate the maximum value of the data:

[0131] ;

[0132] Calculate the minimum value of the data

[0133] ;

[0134] By calculating the mean, standard deviation, maximum and minimum values ​​of the data in each sliding window, the corresponding statistical feature sequence is generated.

[0135] S32. Get the most important feature data set:

[0136] In a possible embodiment, the statistical feature sequence obtained in S31 is further processed to discard the influence of unimportant features on the system, and the important features are sorted, so that the subsequent machine learning judgment is more targeted and the accuracy of the judgment is improved. Therefore, step S32 includes two steps, namely step S321 selects the most important features, and step S322 sorts the most important features obtained in S321 by feature importance, as follows:

[0137] S321. Select the most important features:

[0138] In this embodiment, first, the most important features are selected using the recursive feature elimination (RFE) method;

[0139] The statistical feature sequence is used to select the most important features using the recursive feature elimination (RFE) method to train the initial model , calculate each feature Remove the least important features and retrain the model ,in This step is repeated until the predetermined number of features is reached or the stopping condition is met, which is the feature set after removing the least important feature.

[0140] S322. Sort the most important features by importance:

[0141] In this embodiment, at least one training model is selected for training.

[0142] For linear models:

[0143] ;

[0144] in, Features The weight of .

[0145] For the tree model in the data:

[0146] ;

[0147] in, Representation characteristics In the The importance of a tree, is the total number of trees in the forest.

[0148] Select the most important set of features and rank them using a tree-based feature selection method. Train a tree-based model such as random forest or gradient boosted tree. Calculate the importance score for each feature. , rank the features and select the most important feature set.

[0149] For example, the statistical feature sequences include the mean, standard deviation, maximum, and minimum values ​​of signal strength (RSSI), packet size, transmission rate, and connection frequency.

[0150] Sample 1: [RSSI_mean: 0.3, RSSI_std: 0.2, RSSI_max: 0.5, RSSI_min: 0.1, PacketSize_mean: 0.4, PacketSize_std: 0.3, PacketSize_max: 0.6, PacketSize_min: 0.2, …].

[0151] Sample 2: [RSSI_mean: 0.6, RSSI_std: 0.4, RSSI_max: 0.8, RSSI_min: 0.3, PacketSize_mean: 0.5, PacketSize_std: 0.4, PacketSize_max: 0.7, PacketSize_min: 0.3, …].

[0152] All features can be used to train a linear regression model and calculate feature importance:

[0153] Get feature weights: [RSSI_mean: 0.4, RSSI_std: 0.3, RSSI_max: 0.1, RSSI_min: 0.1, PacketSize_mean: 0.5, PacketSize_std: 0.2, PacketSize_max: 0.2, PacketSize_min: 0.2].

[0154] Remove the least important features: Remove RSSI_max and RSSI_min.

[0155] You can also use a tree-based feature selection method to train a random forest model and calculate feature importance:

[0156] Importance score of the tree:

[0157] Tree 1: RSSI_mean: 0.4, RSSI_std: 0.6, PacketSize_mean: 0.5, PacketSize_std: 0.5;

[0158] Tree 2: RSSI_mean: 0.5, RSSI_std: 0.5, PacketSize_mean: 0.6, PacketSize_std: 0.4;

[0159] Tree 3: RSSI_mean: 0.6, RSSI_std: 0.4, PacketSize_mean: 0.7, PacketSize_std: 0.3.

[0160] Calculate feature importance scores:

[0161] RSSI_mean: (0.4+0.5+0.6) / 3=0.5;

[0162] RSSI_mean: (0.6+0.5+0.4) / 3=0.5;

[0163] RSSI_mean: (0.5+0.6+0.7) / 3=0.6;

[0164] RSSI_mean: (0.5+0.4+0.3) / 3=0.4;

[0165] Sort and select the most important features:

[0166] The most important features: PacketSize_mean: 0.6, RSSI_mean: 0.5, RSSI_std: 0.5.

[0167] Through the above method, the most important features, namely the most important feature data set, are selected: PacketSize_mean, RSSI_mean and RSSI_std. These features will be used as the input of the multimodal deep neural network model to improve the training efficiency and prediction accuracy of the model.

[0168] S4. Based on the most important feature data set, use the machine learning algorithm to generate threat detection results, and obtain a threat report based on the threat detection results.

[0169] The threat report in this embodiment not only includes the danger detection results generated by the machine learning algorithm, but also includes the risk evolution trend obtained by the threat detection results, further improving the risk management level in the power scenario, as follows:

[0170] S41. Generate threat detection results:

[0171] In this embodiment, the most important feature data set of S3 is input into a multimodal deep neural network (MultimodalDNN) model, and the spatial features of each feature data in the most important feature data set are extracted using a one-dimensional convolutional neural network (Conv1D) in the multimodal deep neural network Multimodal DNN model. The time series features of each feature data in the most important feature data set are captured using a long short-term memory network (LSTM) in the multimodal deep neural network Multimodal DNN model. Based on the spatial features and time series features of each feature data in the most important feature data set, a threat detection result is generated through a fully connected layer and an activation function to obtain the classification probability of normal behavior and abnormal behavior, including:

[0172] Input the most important feature datasets into the Multimodal DNN model and format the time series data in the most important feature datasets .

[0173] Use a one-dimensional convolution layer for feature extraction. The convolution layer uses the convolution kernel and bias For input Processed, the output is : .

[0174] After multiple convolutional layers and pooling layers, important spatial features are extracted from the input data and a feature matrix is ​​generated. , the feature matrix Contains processed spatial feature information and provides input for subsequent LSTM.

[0175] Continue to use the long short-term memory network (LSTM) to capture time series features. The feature matrix obtained previously Multiple LSTM units are used to process time series features. For each time step , LSTM updates its hidden state and cell status The LSTM operation consists of four main parts: the input gate , the Forget Gate , output gate , hidden state and cell status renew:

[0176] ;

[0177] Get hidden state sequence , contains the updated hidden state at each time step, reflecting the dynamic changes of time series data. Continue to execute the fully connected layer and activation function to generate threat detection. The fully connected layer uses the weight matrix and bias For the hidden state sequence Perform a linear transformation:

[0178] ;

[0179] The detection results can be obtained through the activation function , such as ReLU (rectified linear unit) or Sigmoid (S-shaped function), a nonlinear transformation is performed on the output of the fully connected layer. If it is a binary classification problem, the Sigmoid function is used to process the output:

[0180] ;

[0181] Finally, the probability of the corresponding behavior will be output, including the classification probability of normal behavior and abnormal behavior. The probability size of the result can reflect the specific probability of whether each data point is normal or abnormal.

[0182] For example, input the most important feature dataset into the Multimodal DNN model and format the time series data in the most important feature dataset:

[0183] Sample 1: [PacketSize_mean: 0.4, RSSI_mean: 0.3, RSSI_std: 0.2];

[0184] Sample 2: [PacketSize_mean: 0.5, RSSI_mean: 0.6, RSSI_std: 0.4];

[0185] After multiple convolutional layers and pooling layers, the long short-term memory network (LSTM) is used to capture time series features. Finally, the fully connected layer and activation function generate threat detection results to obtain:

[0186] Sample 1: [normal behavior probability: 0.7, abnormal behavior probability: 0.3];

[0187] Sample 2: [normal behavior probability: 0.4, abnormal behavior probability: 0.6];

[0188] In this embodiment, a threshold for abnormal behavior alarm is set. When the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs in the power near-field network device and the edge device, and an alarm is displayed in the threat report. That is, when the abnormal probability is greater than 0.5, it is considered abnormal, and the sample behavior is abnormal.

[0189] In other embodiments, the threshold of abnormal behavior alarm is a variable parameter and is adjusted according to actual needs, that is, the threshold can be set according to business needs (for example, a probability greater than 0.5 is considered abnormal, or set to other values), and its probability can be further classified as needed.

[0190] Specifically, the classification probabilities of normal and abnormal behaviors of threat detection results are input into a flexible reporting model for formatting, so that in actual applications, the threshold of the alarm can be adjusted according to additional requirements to obtain the final detailed threat report. The events of the actual application of characteristic indicator threshold alarms include at least characteristic indicators and characteristic indicator alarm thresholds, including:

[0191] The threat detection results (classification probabilities of normal and abnormal behaviors) generated by the multimodal deep neural network model and the set threshold (the threshold is set according to demand. In different business scenarios, the tolerance for security threats may be different. By adjusting the threshold, the conservativeness or aggressiveness of the detection method can be adjusted according to actual business and security needs) are used as parameters to input into the risk threshold function to evaluate the risk level of each feature indicator data. Risk threshold function definition:

[0192] ;

[0193] Probability of threat detection results : Classification probabilities of normal and abnormal behaviors generated by a multimodal deep neural network model.

[0194] Threshold parameter and : User-set high and low risk thresholds, ranging from 0 to 1.

[0195] in, Indicates The risk level of a feature.

[0196] For example:

[0197] Classification probabilities output by a multimodal deep neural network model : 0.7;

[0198] User defined high risk threshold : 0.6;

[0199] User defined low risk threshold : 0.3;

[0200] According to the above definition, when (0.7) greater than or equal to (0.6), the risk level is “high”.

[0201] To obtain a detailed alarm report:

[0202] Characteristic indicators: signal strength (RSSI), multimodal deep neural network model classification probability: 0.7, alarm threshold defined by the user according to actual needs: 0.3-0.6, risk level: high.

[0203] S42. Obtained threat reports:

[0204] In this embodiment, according to the threat detection result of S41, only events that actually apply the characteristic indicator threshold alarm are selected, and the characteristic probability output by the multimodal deep neural network model is input into the risk evolution function to obtain the risk evolution trend and form the final threat report.

[0205] In a possible embodiment, the threat report is generated only for the alarm feature indicators that have been filtered by the user-defined alarm threshold. Further, these alarm feature indicators are input into the risk evolution function, assuming that the classification probability of the current feature indicator corresponding to the output of the multimodal deep neural network model is ,past The risk evolution trend is for:

[0206] ;

[0207] like , indicating an increased risk; if , indicating a reduction in risk.

[0208] For example, the feature index under the user threshold alarm condition, the last feature index corresponds to the classification probability output by the multimodal deep neural network model is 0.6, and the latest feature index corresponds to the classification probability output by the multimodal deep neural network model is 0.7, then , that is, the risk evolution trend is positive, indicating an increase in risk.

[0209] After the above processing, the threat report uses the risk evolution function to obtain the risk evolution trend of the threat detection results, which can predict future risks and improve the level of risk management.

[0210] In a possible embodiment, only events that actually apply characteristic indicator threshold alarms are selected, and based on the associated mapping relationship between the characteristic data of the threat source of the power near-field network and edge equipment and the risk type data table, if the characteristic indicator is in an alarm state, the source of the security threat can be located based on the characteristic data and the risk type.

[0211] Only for the alarm characteristic indicators that have been filtered by the user-defined alarm threshold, by maintaining the association mapping relationship between the threat source characteristic data of the power near-field network and edge equipment and the threat type data table, the source of security threats can be accurately located according to the characteristic data and risk type, for example:

[0212]

[0213] In other embodiments, the threat report formed according to the method of the present application summarizes and outputs multiple types of results and risk trends, including at least:

[0214] Based on the output results of the above steps, a detailed threat report is generated for the characteristic indicators under the user threshold alarm conditions, including at least 5 parts of alarm content, including real-time status, neural model detection, alarm, attack evolution trend, and risk type positioning, to help users quickly locate network security threats and threat change trends. For example:

[0215] Real-time status section:

[0216] Characteristic indicators: signal strength (RSSI);

[0217] Real-time value: -70dBm;

[0218] Timestamp: specific time;

[0219] Neural model detection part:

[0220] Normal behavior probability: 0.3;

[0221] Probability of abnormal behavior: 0.7;

[0222] Warning section:

[0223] User threshold alarm threshold interval: 0.3-0.6;

[0224] Risk level: High;

[0225] Whether the user alarm is triggered: Triggered

[0226] Attack evolution trend:

[0227] Evolution trend: intensified;

[0228] Evolution ratio: 0.1666;

[0229] Risk type positioning part:

[0230] Risk type: external threat;

[0231] Specific risks: physical attack;

[0232] Risk examples: abnormal signal changes, equipment damage.

[0233] In one embodiment, corresponding to the power near-field network and edge device threat source behavior identification and detection method in the above embodiment, Figure 3 A schematic diagram of a power near-field network and edge device threat source behavior identification and detection system provided by an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown. Figure 3 The system comprises:

[0234] A data acquisition module is used to collect data from power near-field network devices and edge devices based on characteristic indicators of multiple characteristic types, and obtain original characteristic data sets containing characteristic data of multiple data types and characteristic data time series;

[0235] The data preprocessing module is used to preprocess the original feature data set obtained by the data acquisition module to obtain a unified time series statistical feature data set;

[0236] A feature data processing module is used to extract statistical features of the unified time series statistical feature data set obtained by the data preprocessing module, and obtain the most important feature data set according to the statistical features;

[0237] The threat report generation module is used to generate threat detection results using a machine learning algorithm based on the most important feature data set obtained by the feature data processing module, and obtain a threat report based on the threat detection results.

[0238] In this embodiment, preprocessing the original feature data set includes: using different normalization methods to process feature data of different data types in the original feature data set to obtain a unified time series statistical feature data set.

[0239] In this embodiment, the data type of the feature data includes numerical data and / or character data.

[0240] In this embodiment, the Min-Max normalization method is directly used to process the numerical data; the character data is converted into numerical data using one-hot encoding, and the Min-Max normalization method is used to process the numerical data to obtain a unified time series statistical feature data set.

[0241] In this embodiment, data collection is based on characteristic indicators of multiple characteristic types of comprehensive power near-field networks and edge devices. Numerical data includes signal strength, and / or data packet size, and / or transmission rate, and character data includes authentication methods, and / or encryption protocols.

[0242] In this embodiment, extracting statistical features of a unified time series statistical feature data set includes: using an algorithm to extract statistical features of a unified time series statistical feature data set to form a statistical feature sequence, wherein the statistical features include at least one or more combinations of mean, standard deviation, maximum value, and minimum value.

[0243] In this embodiment, the algorithm includes a sliding window algorithm.

[0244] In this embodiment, obtaining the most important feature data set according to the statistical features includes: selecting the most important features from the statistical feature sequence, and sorting the most important features by feature importance to obtain the most important feature data set.

[0245] In this embodiment, selecting the most important feature from the statistical feature sequence includes: using a recursive feature elimination method to obtain the most important feature from the statistical feature sequence; and ranking the most important features by feature importance includes: using a tree-based feature selection method to rank the most important features by feature importance.

[0246] In this embodiment, generating threat detection results using a machine learning algorithm includes: inputting the most important feature data set into a multimodal deep neural network Multimodal DNN model, using a one-dimensional convolutional neural network Conv1D in the multimodal deep neural network Multimodal DNN model to extract spatial features of each feature data in the most important feature data set, using a long short-term memory network LSTM in the multimodal deep neural network Multimodal DNN model to capture time series features of each feature data in the most important feature data set, and generating threat detection results based on the spatial features and time series features of each feature data in the most important feature data set through a fully connected layer and an activation function.

[0247] In this embodiment, the threat detection result includes the classification probability of normal behavior and abnormal behavior.

[0248] In this embodiment, a threshold for abnormal behavior alarm is set. When the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs in the power near-field network device and the edge device, and an alarm is displayed in the threat report.

[0249] In this embodiment, the threshold of the abnormal behavior alarm is a variable parameter and is adjusted according to actual needs.

[0250] In this embodiment, the threat report obtained according to the threat detection result includes: a risk evolution trend obtained according to the threat detection result by using a risk evolution function.

[0251] The power near-field network and edge device threat source behavior identification and detection system provided in the embodiments of the present application can execute the power near-field network and edge device threat source behavior identification and detection method provided in any embodiment of the present application, and has the corresponding functional modules and beneficial effects of the execution method.

[0252] like Figure 4 As shown, an embodiment of the present application also provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices provided in any embodiment of the present application are implemented.

[0253] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices provided in any embodiment are implemented.

[0254] An embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices provided in any embodiment.

[0255] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0256] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0257] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0258] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0259] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for identifying and detecting threat source behaviors of power near-field networks and edge devices, characterized in that: include: Based on the characteristic indicators of multiple characteristic types, data is collected from the power near-field network equipment and edge devices to obtain the original characteristic data set containing characteristic data of multiple data types and characteristic data time series; Preprocessing the original feature data set to obtain a unified time series statistical feature data set; Extracting statistical features of the unified time series statistical feature data set, and obtaining the most important feature data set according to the statistical features; Generate a threat detection result using a machine learning algorithm based on the most important feature data set, and obtain a threat report based on the threat detection result; Preprocessing the original feature data set includes: using different normalization methods to process feature data of different data types in the original feature data set to obtain the unified time series statistical feature data set; The data type of the characteristic data includes numerical data and / or character data; The data collection is based on the characteristic indicators of multiple characteristic types of comprehensive power near-field networks and edge devices. The numerical data includes signal strength, and / or data packet size, and / or transmission rate. The character data includes authentication method, and / or encryption protocol. Generating threat detection results using a machine learning algorithm includes: inputting the most important feature data set into a multimodal deep neural network Multimodal DNN model, extracting spatial features of each feature data in the most important feature data set using a one-dimensional convolutional neural network Conv1D in the multimodal deep neural network Multimodal DNN model, capturing time series features of each feature data in the most important feature data set using a long short-term memory network LSTM in the multimodal deep neural network Multimodal DNN model, and generating threat detection results based on the spatial features and time series features of each feature data in the most important feature data set through a fully connected layer and an activation function; The threat detection result includes the classification probability of normal behavior and abnormal behavior; The threat report obtained according to the threat detection result includes: a risk evolution trend obtained according to the threat detection result using a risk evolution function; Evolution of the risks for: ； Indicates the classification probability of the current latest feature index corresponding to the output of the multimodal deep neural network model, Indicates the classification probability of the last feature index corresponding to the output of the multimodal deep neural network model; if , indicating an increased risk; if , indicating a reduction in risk; The threat report is for alarm feature indicators that have been filtered through user-defined alarm thresholds.

2. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 1 is characterized in that: The numerical data is directly processed by the Min-Max normalization method; the character data is converted into numerical data by one-hot encoding, and the numerical data is processed by the Min-Max normalization method to obtain a unified time series statistical feature data set.

3. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 1 is characterized in that: Extracting the statistical features of the unified time series statistical feature data set includes: using an algorithm to extract the statistical features of the unified time series statistical feature data set to form a statistical feature sequence, wherein the statistical features include at least one or more combinations of mean, standard deviation, maximum value, and minimum value.

4. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 3 is characterized in that: The algorithm comprises a sliding window algorithm.

5. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 3 is characterized in that: Acquiring the most important feature data set according to the statistical features includes: selecting the most important features from the statistical feature sequence, and sorting the most important features by feature importance to acquire the most important feature data set.

6. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 5 is characterized in that: Selecting the most important feature from the statistical feature sequence includes: obtaining the most important feature from the statistical feature sequence using a recursive feature elimination method; Sorting the most important features by feature importance includes: using a tree-based feature selection method to sort the most important features by feature importance.

7. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 6 is characterized in that: A threshold for abnormal behavior alarm is set. When the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs in the power near-field network device and the edge device, and an alarm is displayed in the threat report.

8. The method for identifying and detecting threat source behaviors of power near-field networks and edge devices according to claim 7 is characterized in that: The threshold of the abnormal behavior alarm is a variable parameter and is adjusted according to actual needs.

9. A power near-field network and edge device threat source behavior identification and detection system, characterized in that: The system comprises: A data acquisition module is used to collect data from power near-field network devices and edge devices based on characteristic indicators of multiple characteristic types, and obtain original characteristic data sets containing characteristic data of multiple data types and characteristic data time series; A data preprocessing module is used to preprocess the original feature data set to obtain a unified time series statistical feature data set; A feature data processing module, used to extract statistical features of the unified time series statistical feature data set, and obtain the most important feature data set according to the statistical features; A threat report generation module, used to generate a threat detection result based on the most important feature data set using a machine learning algorithm, and obtain a threat report based on the threat detection result; Preprocessing the original feature data set includes: using different normalization methods to process feature data of different data types in the original feature data set to obtain the unified time series statistical feature data set; The data type of the characteristic data includes numerical data and / or character data; The data collection is based on the characteristic indicators of multiple characteristic types of comprehensive power near-field networks and edge devices. The numerical data includes signal strength, and / or data packet size, and / or transmission rate. The character data includes authentication method, and / or encryption protocol. Generating threat detection results using a machine learning algorithm includes: inputting the most important feature data set into a multimodal deep neural network Multimodal DNN model, extracting spatial features of each feature data in the most important feature data set using a one-dimensional convolutional neural network Conv1D in the multimodal deep neural network Multimodal DNN model, capturing time series features of each feature data in the most important feature data set using a long short-term memory network LSTM in the multimodal deep neural network Multimodal DNN model, and generating threat detection results based on the spatial features and time series features of each feature data in the most important feature data set through a fully connected layer and an activation function; The threat detection result includes the classification probability of normal behavior and abnormal behavior; The threat report obtained according to the threat detection result includes: a risk evolution trend obtained according to the threat detection result using a risk evolution function; Evolution of the risks for: ； Indicates the classification probability of the current latest feature index corresponding to the output of the multimodal deep neural network model, Indicates the classification probability of the last feature index corresponding to the output of the multimodal deep neural network model; if , indicating an increased risk; if , indicating a reduction in risk; The threat report is for alarm feature indicators that have been filtered through user-defined alarm thresholds.

10. The power near-field network and edge device threat source behavior identification and detection system according to claim 9 is characterized in that: The numerical data is directly processed by the Min-Max normalization method; the character data is converted into numerical data by one-hot encoding, and the numerical data is processed by the Min-Max normalization method to obtain a unified time series statistical feature data set.

11. The power near-field network and edge device threat source behavior identification and detection system according to claim 9 is characterized in that: Extracting the statistical features of the unified time series statistical feature data set includes: using an algorithm to extract the statistical features of the unified time series statistical feature data set to form a statistical feature sequence, wherein the statistical features include at least one or more combinations of mean, standard deviation, maximum value, and minimum value.

12. The power near-field network and edge device threat source behavior identification and detection system according to claim 11 is characterized in that: The algorithm comprises a sliding window algorithm.

13. The power near-field network and edge device threat source behavior identification and detection system according to claim 11 is characterized in that: Acquiring the most important feature data set according to the statistical features includes: selecting the most important features from the statistical feature sequence, and sorting the most important features by feature importance to acquire the most important feature data set.

14. The power near-field network and edge device threat source behavior identification and detection system according to claim 13 is characterized in that: Selecting the most important feature from the statistical feature sequence includes: obtaining the most important feature from the statistical feature sequence using a recursive feature elimination method; Sorting the most important features by feature importance includes: using a tree-based feature selection method to sort the most important features by feature importance.

15. The power near-field network and edge device threat source behavior identification and detection system according to claim 14 is characterized in that: A threshold for abnormal behavior alarm is set. When the probability of abnormal behavior in the threat detection result is greater than the threshold for abnormal behavior alarm, it is determined that abnormal behavior occurs in the power near-field network device and the edge device, and an alarm is displayed in the threat report.

16. The power near-field network and edge device threat source behavior identification and detection system according to claim 15 is characterized in that: The threshold of the abnormal behavior alarm is a variable parameter and is adjusted according to actual needs.

17. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices as described in any one of claims 1 to 8 are implemented.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for identifying and detecting behavior of threat sources of power near-field networks and edge devices as described in any one of claims 1 to 8 are implemented.

Images