Abnormal behavior detection method and system adaptive to distributed power supply dispatching control network

Abstract

The application discloses an abnormal behavior detection method and system suitable for a distributed power source scheduling control network. The method comprises the following steps: capturing traffic data from the distributed power source scheduling control network by a traffic monitoring method, collecting security audit data of the distributed power source scheduling control network; utilizing a knowledge graph to deduce an association between the traffic data and the security audit data, and obtaining derived feature data in the distributed power source scheduling control network; constructing an input data set by using the traffic data, the security audit data and the derived feature data, inputting the input data set into a gradient boosting decision tree model, and obtaining an abnormal behavior classification model of the distributed power source scheduling control network; monitoring a current traffic state in the distributed power source scheduling control network, obtaining a current abnormal behavior of the current traffic state by using the abnormal behavior classification model, and implementing an abnormal event response based on the current abnormal behavior.

Description

Technical Field

[0001] This invention relates to the field of power systems, and more specifically, to an abnormal behavior detection method, system, terminal, and computer-readable storage medium adapted to distributed power source dispatch and control networks. Background Technology

[0002] With the rapid development of power systems and the integration of new energy sources such as wind and solar power, the widespread application of distributed power sources, primarily based on new energy sources, and related high-proportion power electronic equipment will bring about fundamental changes in the operating characteristics, safety control, and production modes of new power systems. As the scale of new power systems grows larger and their operating modes and control methods become increasingly complex, accurately grasping the characteristics and patterns of normal grid operation becomes increasingly difficult, which significantly increases the control difficulty and operational risks of the power grid.

[0003] Distributed power dispatch and control networks include power generation facilities, systems, and combined cooling, heating, and power (CCHP) systems. Network equipment is often located near user locations. Electricity generated in distributed power systems is used by users themselves and locally, and surplus electricity is fed into the local distribution network. Distributed power generation methods are diverse and can be divided into three main categories based on resource conditions and energy demand: The first category is natural gas distributed energy, mainly including combined heat and power (CHP) and combined cooling, heating, and power (CCHP); the second category is renewable energy distributed power generation, mainly covering small-scale hydropower, solar energy, wind energy, biomass energy, and geothermal energy; the third category is comprehensive utilization of waste resources, including power generation from industrial waste pressure, waste heat, and waste combustible gases, as well as power generation from municipal waste and sludge.

[0004] Under the aforementioned conditions, distributed power dispatch and control networks interact with a variety of external network environments, external devices, and external services. This not only requires the distributed power dispatch and control network to have excellent data interaction and analysis capabilities but also demands high levels of real-time data processing. However, current distributed power control system networks are riddled with security vulnerabilities, and the network protection of the distributed power control system itself has weaknesses, making it difficult to completely eliminate risks. This leads to further potential hazards during real-time interaction and control with external services. Therefore, continuous security data collection, monitoring, and analysis are essential during real-time system operation.

[0005] However, typical security monitoring agents operate within the host system environment, collecting and analyzing application software runtime environment information, but their monitoring scope is limited and they cannot detect encrypted communication information. Furthermore, due to the high cost of distributed power supplies, most distributed power terminals are unattended. In the event of an information security incident, these distributed power terminals are typically unable to handle the incident promptly and effectively.

[0006] Furthermore, with the rapid development of power systems and the large-scale integration of new energy sources, power grid network security incidents occur frequently, and the risks and costs of grid failures are increasing. Accurately grasping the characteristics and patterns of safe grid operation, quickly and precisely identifying grid weaknesses, and responding promptly to grid failures are crucial for maintaining stable power system operation and preventing various safety incidents. Although anomaly monitoring technology can help new power systems achieve effective security management and improve the ability to perceive security threats, this technology still cannot be effectively applied in the complex operational environment of distributed power dispatch and control networks.

[0007] To address the aforementioned issues, there is an urgent need to research automatic handling technologies for network anomalies in distributed power scheduling and control systems, in order to cope with this situation. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides an abnormal behavior detection method and system adapted to distributed power scheduling and control networks. By capturing traffic data, security audit data, and business data, the system expands and analyzes the derived features of the data using knowledge graph inference, and classifies the abnormal types of the scheduling and control network using decision trees, and implements abnormal responses for each type.

[0009] The present invention adopts the following technical solution.

[0010] The first aspect of this invention relates to an abnormal behavior detection method adapted to a distributed power scheduling and control network. The method includes the following steps: capturing traffic data from the distributed power scheduling and control network using a traffic monitoring method, and collecting security audit data of the distributed power scheduling and control network; using a knowledge graph to infer and analyze the correlation between the traffic data and the security audit data, and obtaining derived feature data in the distributed power scheduling and control network; constructing an input dataset using the traffic data, security audit data, and derived data features, and inputting the input dataset into a gradient boosting decision tree model to obtain an abnormal behavior classification model of the distributed power scheduling and control network; monitoring the current traffic state in the distributed power scheduling and control network, using the abnormal behavior classification model to obtain the current abnormal behavior of the current traffic state, and implementing an abnormal event response based on the current abnormal behavior.

[0011] Preferably, traffic data is captured from the distributed power scheduling and control network using a traffic monitoring method, including: the traffic data includes transmission time, reception time, source IP address, destination IP address, network hop node IP, number of network hop nodes, data packet size, data flow direction, time of the last received data packet, time of the last sent data packet, source port, destination port, total number of uplink and downlink data packets, total number of uplink and downlink payloads, total uplink and downlink load, traffic duration, average load, maximum and minimum load, average time interval of uplink and downlink data packets, minimum time interval, and maximum time interval of uplink and downlink data packets.

[0012] Preferably, the security audit data collected from the distributed power dispatch and control network includes: data security alarms, operation security alarms, equipment security alarms, database security checks, data operation logs, business operation logs, audit logs, alarm levels, and open service records.

[0013] Preferably, the correlation between the traffic data and the security audit data is analyzed using knowledge graph inference to obtain derived feature data in the distributed power scheduling and control network, including: for each piece of traffic data, using knowledge graph inference to obtain the data content in the security audit data related to each piece of traffic data; and inferring the derived feature data corresponding to each piece of traffic data based on the traffic data and the data content in the security audit data related to each piece of traffic data; the data dimensions in the derived feature data include open service features, vulnerability features, and impact factor features.

[0014] Preferably, the derivation of the derived feature data corresponding to each piece of traffic data is based on the data content related to each piece of traffic data in the traffic data and the security audit data, including: constructing a derivation model for each data dimension in the derived feature data through the knowledge graph derivation, and assigning traffic data, security audit data and business data at different times to the derivation model to obtain the value of each data dimension.

[0015] Preferably, the deduction model for open service features is as follows: using the destination IP address in the traffic data, deducing the destination system name corresponding to the destination IP address; using the destination system name, deducing the destination domain to which the destination system name belongs; using the destination domain, deducing the destination security zone corresponding to the destination domain; using the destination security zone, deducing the open service level to which the destination security zone belongs; the correspondence between the destination IP address and the destination system name, the attribution relationship between the destination system name and the destination domain, the correspondence between the destination domain and the destination security zone, and the attribution relationship between the destination security zone and the open service level are pre-stored in the deduction model for open service features in the form of a business data table.

[0016] Preferably, the vulnerability feature deduction model is as follows: using the destination IP address and source IP address in the traffic data to deduce the destination security zone and source security zone of the traffic data, respectively; based on the destination security zone and the source security zone, infer the service flow direction of the traffic data; using the device ID in the traffic data to deduce the physical environment of the traffic data; using the service data type of the traffic data to deduce the data processing method of the traffic data; and through the service flow direction, physical environment, and data processing method of the traffic data, deduce the vulnerability level and vulnerability assessment quantity of the traffic data.

[0017] Preferably, the vulnerability level and vulnerability assessment value of the traffic data are deduced based on the business flow, physical environment, and data processing method of the traffic data, including: analyzing the business flow type, physical environment type, and data processing method type of the traffic data, and assigning attribute values ​​to each different type; arranging and combining the attribute values ​​of the business flow type, physical environment type, and data processing method type of the traffic data to obtain the vulnerability level of the traffic data; and weighted summing the attribute values ​​of the business flow type, physical environment type, and data processing method type of the traffic data to obtain the vulnerability assessment value of the traffic data.

[0018] Preferably, the inference model for the characteristics of the influencing factors is as follows: using the data content related to each piece of traffic data in the security audit data corresponding to the traffic data, the alarm information of the traffic data is extracted; the alarm level of the alarm information is inferred using the alarm information; the business data interaction range of the traffic data is inferred using the alarm information; and the influencing factors of the traffic data are inferred through the data flow direction of the traffic data, the business data interaction range, and the alarm level of the alarm information.

[0019] Preferably, the impact factors of the traffic data are deduced based on the data flow direction of the traffic data, the scope of the business data interaction, and the alarm level of the alarm information, including: deriving the evaluation quantity of the impact factors of the traffic data based on the pre-set impact degree level rules.

[0020] Preferred,

[0021] The process involves using a knowledge graph to deduce and analyze the relationships between the traffic data and the security audit data, and to obtain derived feature data in the distributed power scheduling and control network. This includes: using a knowledge graph to deduce and analyze all correspondences and attributions between the traffic data, the security audit data, and the business data, and generating a basic knowledge graph; traversing the deduction process from the basic knowledge graph to obtain all derived features of the basic knowledge graph; using the SVM algorithm to extract multiple optimal derived features from all derived features, and using the multiple optimal derived features to simplify the basic knowledge graph.

[0022] Preferably, the business data includes the relationships between basic data stored in advance in the form of business data tables, as well as pre-set rules for obtaining derived features.

[0023] Preferably, an input dataset is constructed using the traffic data, security audit data, and derived data features. The input dataset is then input into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network. This includes selecting multiple hyperparameters to be optimized from the gradient boosting decision tree, minimizing the cross-entropy loss of the decision tree, and using the Grey Wolf algorithm to optimize the multiple hyperparameters.

[0024] Preferably, an input dataset is constructed using the traffic data, security audit data, and derived data features. This input dataset is then input into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling control network. The process includes: randomly sorting the input dataset to obtain multiple measurement sample vectors; for the current sample among the multiple measurement sample vectors, adjusting multiple feature values ​​in the current sample's measurement sample vector using the prior samples of each current sample, the probability distribution function of the current sample's feature values, and the prior label of the current sample to generate a new measurement sample vector; and constructing a new input dataset based on the multiple new measurement sample vectors and inputting it into the gradient boosting decision tree model.

[0025] Preferably, for the current sample among the plurality of measurement sample vectors, multiple feature values ​​in the measurement sample vector of the current sample are adjusted using the prior samples of each current sample, the probability distribution function of the feature values ​​of the current sample, and the prior label of the current sample to generate a new measurement sample vector, including:

[0026] The k-th feature value x of the σ(j)th sample σ(j),k Represented as:

[0027]

[0028] In the formula, Y σ(j) Let σ(j) be the prior label value corresponding to the classification label of the current sample.

[0029] p represents the number of samples in the added prior distribution term.

[0030] 'a' is the weighting coefficient.

[0031] P[·] is the probability distribution function of the feature values ​​of the current sample.

[0032] The k-th feature of sample σ(j) is x σ(p),k The feature value of the prior sample is x σ(i),k .

[0033] Preferably, the current traffic status in the distributed power scheduling and control network is monitored, the current abnormal behavior of the current traffic status is obtained using the abnormal behavior classification model, and an abnormal event response is implemented based on the current abnormal behavior, including: providing an abnormal event response method for each abnormal behavior type in the abnormal behavior classification model; and selecting the corresponding abnormal event response method to respond to the current traffic status abnormally for the abnormal behavior type of the current abnormal behavior.

[0034] A second aspect of this invention relates to an abnormal behavior detection system adapted to a distributed power scheduling and control network. The system utilizes an abnormal behavior detection method adapted to a distributed power scheduling and control network as described in the first aspect of this invention. The system includes a capture module, an inference module, a classification module, and a response module. The capture module is used to capture traffic data from the distributed power scheduling and control network using a traffic monitoring method and to collect security audit data from the distributed power scheduling and control network. The inference module is used to use a knowledge graph to infer and analyze the correlation between the traffic data and the security audit data, and to obtain derived feature data in the distributed power scheduling and control network. The classification module is used to construct an input dataset using the traffic data, security audit data, and derived data features, and input the input dataset into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network. The response module is used to monitor the current traffic state in the distributed power scheduling and control network, use the abnormal behavior classification model to obtain the current abnormal behavior of the current traffic state, and implement an abnormal event response based on the current abnormal behavior.

[0035] A third aspect of the present invention relates to a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to perform operations according to the instructions to execute the steps of the method in the first aspect of the present invention.

[0036] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method of the first aspect of the present invention.

[0037] The beneficial effects of this invention are that, compared with the prior art, the abnormal behavior detection method adapted to distributed power dispatching and control networks in this invention captures traffic data, security audit data, and business data, expands and analyzes the derived features of the data through knowledge graph inference, and classifies the abnormal types of the dispatching and control network through decision trees, implementing abnormal responses for each type. This invention utilizes automatic handling technology to quickly and accurately detect abnormal situations and take appropriate measures to mitigate potential risks and threats, significantly improving the accuracy and effectiveness of abnormal event response.

[0038] The beneficial effects of the present invention also include:

[0039] 1. Through knowledge graph inference, the association of multi-dimensional features in each traffic data is effectively established, and various types of data association tables and human-defined derivative indicator rules are integrated into the knowledge graph corresponding to each traffic data. An inference process is established for each traffic data, thereby obtaining the data foundation for implementing abnormal event detection and classification.

[0040] 2. The multi-source derived features in this invention can be effectively applied to the analysis and mining of potential multi-platform, multi-source data content, thereby obtaining abnormal behavior monitoring for traffic data. This derived feature extraction process considers all the inherent relationships between massive amounts of data and implements key feature extraction through supervised learning, fully ensuring the efficiency and reliability of the derived feature mining process used for abnormal behavior classification.

[0041] 3. This invention employs a decision tree algorithm, using extracted derived features as the basis for classifying abnormal behaviors, and utilizes the Grey Wolf algorithm to optimize the decision tree. By analyzing the prior distribution of various features, the derivative features or original feature values ​​of the traffic data are re-planned, overcoming the bias in the mathematical calculation process of the decision tree and improving the accuracy of the GBDT algorithm. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating the derivation of derived features in an abnormal behavior detection method adapted to a distributed power scheduling and control network according to the present invention.

[0043] Figure 2 This is a schematic diagram illustrating the derivation path of open service derived indicators in an abnormal behavior detection method adapted to a distributed power scheduling and control network according to the present invention.

[0044] Figure 3 This is a schematic diagram of the vulnerability feature deduction path in an abnormal behavior detection method adapted to a distributed power scheduling and control network in this invention.

[0045] Figure 4 This is a schematic diagram illustrating the deduction path of the influencing factor characteristics in the abnormal behavior detection method adapted to distributed power scheduling and control networks of the present invention.

[0046] Figure 5 This is a schematic diagram summarizing the classification of common abnormal events in the abnormal behavior detection method adapted to distributed power scheduling and control networks of the present invention.

[0047] Figure 6 This is a schematic diagram of the abnormal event detection process in an abnormal behavior detection method adapted to a distributed power scheduling and control network according to the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this invention are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments not described in this invention obtained by those skilled in the art based on the embodiments described in this invention without creative effort should fall within the protection scope of this invention.

[0049] With the continuous evolution of cyber threats, intelligent analysis technology for security threats in distributed power dispatch and control has become a critical area, aiming to improve the cybersecurity of energy distribution and dispatch systems. Multiple energy distribution and dispatch systems may need to share large amounts of sensitive data, such as power network topology and real-time load data. This can lead to risks of data privacy leaks and data tampering, and attackers may attempt to intrude into and disrupt collaborative detection systems, thereby interfering with power distribution.

[0050] Traditional threat detection methods may be insufficient to address emerging and complex threats. Intelligent analytics can extract patterns and anomalies from massive amounts of data, helping to identify potential security threats, including intrusions, malfunctions, and operational errors. In power systems, rapid identification and response to security threats are crucial to reducing potential damage and disruption. Intelligent analytics can facilitate faster threat detection, enabling timely corrective action.

[0051] Therefore, in order to improve the security of the power system, ensure the normal operation of society and the economy, and cope with the ever-evolving security threats, it is necessary to comprehensively utilize advanced technologies to achieve intelligent analysis and rapid response to security incidents.

[0052] The new power systems are characterized by diverse components, large scale, and more remote locations. Therefore, they employ numerous intelligent sensors and automated control systems to monitor and control the system's operational status in real time, ensuring stable operation. However, the widespread integration of distributed power sources extends the security boundary, and comprehensive sensing and highly intelligent operation increase system complexity, thereby raising the potential risk of cyberattacks. With the rapid development of new technologies, cybersecurity threats are constantly evolving, with new and covert attack methods emerging. Attackers can maliciously control devices and control systems to carry out large-scale destructive actions, such as command injection, data injection, and configuration alteration.

[0053] Therefore, it is not only necessary to rationally and effectively integrate data collected from multiple platforms when analyzing abnormal events in distributed energy networks, but also to provide effective and targeted event responses for the analyzed abnormal events in order to effectively address the anomalies and risks of distributed power grids and improve the timeliness, systematicness, pertinence and effectiveness of network anomaly response.

[0054] To address the aforementioned problems, the first aspect of this invention relates to a method for detecting abnormal behavior in distributed power scheduling and control networks. The method includes steps 1 to 4.

[0055] Step 1: Capture traffic data from the distributed power dispatch and control network using traffic monitoring methods, and collect security audit data of the distributed power dispatch and control network.

[0056] This invention employs a fusion approach of traffic monitoring and expert knowledge base for feature analysis to detect network anomalies. First, traffic monitoring uses actively captured traffic data to select the necessary traffic features for analysis. These traffic features typically include basic data such as the number and size of data packets, transmission and reception times, data flow direction, frequency of data transmission and reception, data protocol format, source address, destination address, and port.

[0057] Secondly, security audit data is collected as a data source. The data dimensions of this type of data source include security alerts, security verification, log audits, open services, etc. By analyzing the status of traffic data through this part, security information and alert information can be provided.

[0058] Preferably, traffic data is captured from the distributed power dispatch control network using a traffic monitoring method. This traffic data includes: transmission time, reception time, source IP address, destination IP address, network hop node IP, number of network hop nodes, data packet size, data flow direction, time of the last received data packet, time of the last transmitted data packet, source port, destination port, total number of uplink and downlink data packets, total number of uplink and downlink payloads, total uplink and downlink load, traffic duration, average load, maximum and minimum load, average time interval of uplink and downlink data packets, minimum time interval, and maximum time interval of uplink and downlink data packets.

[0059] Given the wide distribution, numerous nodes, and complex communication characteristics of distributed energy networks, a point-to-point transmission path full-path traffic feature extraction method is adopted. Traffic feature values ​​can be extracted from various data packets, with the 21 commonly used features mentioned above. The data flow direction is either north-south or south-south. Each feature value is stored in a specific location within each data packet, such as the packet header, according to the data protocol related to distributed power sources. When traffic data is captured through traffic monitoring, the corresponding information can be extracted from specific locations within the packet for analysis.

[0060] In one embodiment, each traffic acquisition packet is treated as a node, and all data packets collected within a unit of time are defined as a dataset. The data packets in the dataset, i.e. each data node, can be described according to 21 feature values, thus obtaining a 21-dimensional spatiotemporal data set.

[0061] According to the definition, all features within the spatiotemporal set of data are quantized to obtain a quantized, readable, ordered spatiotemporal dataset. This quantization process can be achieved through digital processing.

[0062] Preferably, the security audit data collected from the distributed power dispatch and control network includes: security audit data including data security alarms, operation security alarms, equipment security alarms, database security checks, data operation logs, business operation logs, audit logs, alarm levels, and open service records.

[0063] The above information can be obtained through real-time monitoring and analysis of various safety and alarm information by alarm devices or control systems in the distributed power dispatch and control network using various methods such as hardware and software. This information is derived from traffic data, the basic data content. Therefore, each alarm message can correspond to one or more traffic data points and provide information on the potential risks associated with that traffic data.

[0064] However, potential traffic risks in existing technologies cannot be analyzed and identified using a uniform method. This is because the traffic data involved in potential traffic risks comes from different sources, types, functions, and transmission methods. Furthermore, actual network anomalies may manifest as a combination of anomalies in multiple traffic data sets. Therefore, simply analyzing the anomaly of a single traffic data set or a single type of traffic data set is insufficient to accurately classify abnormal network behavior or trace its reasonable causes.

[0065] To address the aforementioned issues, this invention employs knowledge graph deduction to obtain the relationships between data from various dimensions, systematically analyzes the inherent connections between data, and obtains derived data features based on human-defined rules, thereby providing a foundation for the classification of abnormal behaviors.

[0066] Therefore, in addition to capturing traffic data and collecting security audit data, this application also pre-obtains a large number of data relationship analysis tables and system operation information. This content is referred to as business data in this invention. Preferably, the business data includes the relationships between basic data stored in advance in the form of business data tables, as well as pre-set derived feature division rules.

[0067] For example, business data can provide service levels for open services, such as rule definitions for Level 1, Level 2, and Level 3 services. Since various devices in the distributed power dispatch and control network operate within the power system, these devices are divided and located in different power business areas according to their security levels. Common business areas are partitioned based on the required security level for the business. According to documents such as the "Regulations on Security Protection of Power Monitoring Systems," and considering the characteristics of the power secondary system, the production control area is divided into a control area (Security Zone I) and a non-control area (Security Zone II), while the information management area is divided into a production management area (Security Zone III) and a management information area (Security Zone IV). Based on the above, the security levels of Security Zone I to Security Zone IV decrease progressively.

[0068] According to the above arrangement, the business data of this invention includes the external system, network area, and region where the IP addresses of various devices are located, as well as the security zone type to which different devices belong. This content can be stored in a pre-set data table with a fixed format, as part of the business data, for subsequent construction of the knowledge graph.

[0069] Similarly, the method of this invention also supports the classification of each different type of traffic data. This classification process includes dividing the traffic data into smaller business subcategories and larger business classifications. By obtaining the business type corresponding to a message, it is also possible to further obtain the business and system corresponding to a particular message, thereby determining the message generation method based on the business situation, such as whether the data is obtained automatically through system background operation or data triggered by manual operation by business personnel, etc. In addition, the business data may also include the classification of different alarm information levels, the business types corresponding to different alarm levels, the geographical scope involved in the business, etc.

[0070] Based on various external access services, the method of this invention supports the timely updating of new business logic in the aforementioned business data, thereby identifying hidden derivative features in various traffic data and security audit data through the inherent correlation of business logic.

[0071] As described above, business data primarily contains correlation information between various data types, stored in one or more data tables. For example, each business system involved in the network corresponds to multiple specific power devices capable of implementing that business. These specific power devices are recorded in a device whitelist for that business system, while other power devices are not recorded in this whitelist. During subsequent monitoring of business traffic and inference using a knowledge graph, if it is found that the business system corresponding to the destination IP address of a certain traffic data is inconsistent with the business type within that traffic data, a risk issue is discovered.

[0072] Similarly, the whitelist table may also include the relationship between business systems and device regions, the correspondence between device regions and security zones, the relationship between security zones and open service levels, the relationship between traffic packet types and business types, the relationship between business types and data processing methods, and so on.

[0073] With the support of the aforementioned data, this invention fully collects traffic data, security audit data, and business data to construct a knowledge graph.

[0074] In one embodiment, traffic data and business data are digitized using an internal system data dictionary. This includes digitizing data dimensions such as alarms, threat information, IP addresses, ports, and load. Other data dimensions are converted to text using low-dimensional target embedding and natural language processing methods. All text information is processed according to the "text-to-digital text conversion" principle. In another embodiment, supervised learning is used to remove noise from the original data while retaining essential features, thus converting text data into numerical data content. This simplifies the data while preserving important data characteristics.

[0075] For the large amount of alarm data contained in security audit data, the alarm data can also be formatted and converted through expert classification. For example, regular alarm data can be divided into threat data and non-threat data. In one embodiment, alarm data is divided into multiple levels according to severity, with severe and important alarm data classified as threats, and minor, moderate, and ordinary alarm data classified as non-threats. This data content and threat classification are used in subsequent knowledge graph construction and inference.

[0076] In one embodiment, for data with a small amount of data but many features, the SVM method may be used to classify multiple features into different feature categories. Each feature category serves as a dimension, providing a data foundation for detecting abnormal network behavior. For example, in one embodiment, existing data is classified in multiple dimensions to obtain multiple dimension types such as IP address, abnormal event, data flow, alarm level, and device. Only the evaluation metrics of these dimensions are used in the subsequent detection model to analyze the current abnormal state, which greatly simplifies the number of data features and improves model efficiency.

[0077] Step 2: Use knowledge graphs to infer and analyze the relationship between traffic data and security audit data, and obtain derived feature data in the distributed power scheduling and control network.

[0078] Figure 1This is a schematic diagram illustrating the derived feature derivation process in an abnormal behavior detection method adapted to distributed power scheduling and control networks according to the present invention. Figure 1 As shown, after obtaining the large amount of raw data, this invention constructs the intrinsic relationship between multi-dimensional data through a knowledge graph, and performs relationship deduction between various originally unrelated data contents by establishing a knowledge graph, thereby obtaining the derived features of the raw data, which can be used to provide potential and valuable derived features for anomaly detection.

[0079] Preferably, the association between traffic data and security audit data is analyzed using knowledge graphs to obtain derived feature data in the distributed power scheduling and control network. This includes: analyzing all correspondences and attribution relationships between traffic data, security audit data, and business data using knowledge graphs, and generating a basic knowledge graph; traversing the deduction process from the basic knowledge graph to obtain all derived features of the basic knowledge graph; using the SVM algorithm to extract multiple optimal derived features from all derived features, and using these multiple optimal derived features to simplify the basic knowledge graph.

[0080] This invention employs a basic knowledge graph construction method to obtain a foundational knowledge graph, which contains a large amount of redundant information and redundant relationships between knowledge points. Finding effective knowledge deduction paths from this foundational knowledge graph is fundamental to accurate anomaly behavior deduction. Therefore, this invention uses the SVM algorithm to continuously test and eliminate derived features generated by arbitrary deductions from the foundational knowledge graph, and extracts one or more derived features that best reflect the type of anomaly behavior, thereby filtering out the key data that truly leads to impact.

[0081] It's easy to see that since the SVM algorithm can perform binary or multi-class classification on data with multi-dimensional features, we can use the various derived features obtained from the basic knowledge graph as multi-dimensional features of the SVM input data, and treat each traffic data point as a sample. This allows us to calculate the sample's position relative to the decision plane using support vectors, thus obtaining the sample's classification. During the classification process, we find the value of the scoring function for each classification feature and determine the feature's importance based on the scoring function, thereby selecting one or more of the most critical features.

[0082] This invention can obtain many derived features through a basic knowledge graph. These derived features inevitably contain redundancies, and some are completely unrelated to abnormal behavior classification. For example, it's easy to see a correlation between the service type and data length of traffic packets, and this correlation is part of the service data extracted in step 1. However, the derived features obtained by analyzing the relationship between the IP address and data length of traffic data are clearly not very helpful for the subsequent abnormal behavior analysis model. But the basic knowledge graph automatically extracts all derived features. This necessitates using the SVM method to simplify the derived features.

[0083] In one embodiment of the present invention, the simplified data content only includes open service characteristics, vulnerability characteristics, and impact factor characteristics.

[0084] Preferably, the relationship between traffic data and security audit data is analyzed using knowledge graph inference, and derived feature data in the distributed power scheduling and control network is obtained. This includes: for each piece of traffic data, using knowledge graph inference to obtain the data content related to each piece of traffic data in the security audit data; and inferring the derived feature data corresponding to each piece of traffic data based on the data content related to each piece of traffic data in the traffic data and security audit data. The data dimensions in the derived feature data include open service features, vulnerability features, and impact factor features.

[0085] In this invention, predefining appropriate business data is also an important way to provide more paths for the knowledge graph and obtain the desired inference path. For example, by predefining the relationship between traffic data flow direction, device physical environment, data processing method and vulnerability index, a reasonable inference of the vulnerability level derivative index in the knowledge graph can be obtained. By defining the association between data flow direction and business data interaction scope, the inference method of this derivative index in the knowledge topology can also be obtained. This part will be described in more detail later.

[0086] Preferably, the derived feature data corresponding to each piece of traffic data is deduced based on the data content related to each piece of traffic data and security audit data. This includes: constructing a deduction model for each data dimension in the derived feature data through knowledge graph deduction, and assigning traffic data, security audit data and business data at different times to the deduction model to obtain the value of each data dimension.

[0087] In one embodiment of the present invention, the data content of the associated security audit data for each traffic data is first obtained, and then the derived feature data for each traffic data is obtained from the inference graph. For example, some traffic data may correspond to alarm data, so the alarm type, alarm level, and other content of the alarm data can be associated with this traffic data. After association, the values ​​of the derived features for this traffic data can be obtained through knowledge graph inference. A similar inference is performed for each traffic data to obtain multiple different values ​​of derived features. This amount of data will provide explicit implicit data features for subsequent abnormal behavior classification, thereby ensuring that the results of abnormal behavior classification are more accurate.

[0088] Open services, vulnerabilities, and impact factors are new feature values ​​obtained by removing redundant derived features through SVM. These new derived features are also formulated by comprehensively considering the actual needs of anomaly response and network threat analysis, and by adding business data according to the actual situation.

[0089] Preferably, the deduction model for open service characteristics is as follows: using the destination IP address in the traffic data, the destination system name corresponding to the destination IP address is deduced; using the destination system name, the destination domain to which the destination system name belongs is deduced; using the destination domain, the destination security zone corresponding to the destination domain is deduced; using the destination security zone, the open service level to which the destination security zone belongs is deduced; the correspondence between the destination IP address and the destination system name, the attribution relationship between the destination system name and the destination domain, the correspondence between the destination domain and the destination security zone, and the attribution relationship between the destination security zone and the open service level are pre-stored in the deduction model for open service characteristics in the form of a business data table.

[0090] As described above, the correspondence between destination IP addresses and destination system names, the attribution relationship between destination system names and destination domains, the correspondence between destination domains and destination security zones, and the attribution relationship between destination security zones and open service levels are part of the business data. This content involves the inference model of key derived features extracted from the knowledge graph, and therefore can also be stored in the inference model. Here, the inference model is a simplified basic knowledge graph, which can also be understood as a collection of one or more reasoning paths in the knowledge graph. The starting point of this reasoning path is usually the various types of data collected in step 1, while the endpoint is one or more derived features, such as destination security zone nodes, data flow, physical environment, etc. If this invention pre-adds various artificially set derived features such as vulnerability indicators and impact factor indicators to the knowledge graph, then the artificially set indicators can also be used as the endpoint of the path.

[0091] Figure 2This is a schematic diagram illustrating the derivation path of open service derived indicators in an abnormal behavior detection method adapted to distributed power scheduling and control networks according to the present invention. For example... Figure 2 As shown, by utilizing the destination IP address in the traffic data and the association between the IP address and system name in the business data, the destination system name of the traffic data is obtained. Based on the attribution relationship between the destination system name and the destination domain, the destination domain of this traffic data is obtained. Figure 2 The path within the code ultimately yields the level of open services.

[0092] The business data involved in this part of the simulation model is pre-stored in the model. This business data involves the classification method of open services. For example, open services are divided into Level 1 services, Level 2 services, and Level 3 services. Level 1 services refer to external services to other systems located in Security Zone II; Level 2 services refer to external services to other systems located in Security Zone III; and Level 3 services refer to external services to other systems located in Security Zone III.

[0093] Therefore, by using the mapping table between the destination IP address and the destination system name, we can find the destination system name, then determine the region where the destination address is located, further obtain the security zone where the destination system is located, and finally deduce the service level corresponding to the open service based on the characteristics of the open service.

[0094] The preferred vulnerability feature deduction model is as follows: using the destination IP address and source IP address in the traffic data to deduce the destination security zone and source security zone of the traffic data, respectively; inferring the service flow direction of the traffic data based on the destination security zone and source security zone; deducing the physical environment of the traffic data using the device ID in the traffic data; deducing the data processing method of the traffic data using the service data type of the traffic data; and deducing the vulnerability level and vulnerability assessment quantity of the traffic data through the service flow direction, physical environment and data processing method of the traffic data.

[0095] Vulnerability typically refers to the inadequacy of distributed power system assets and their protective measures in terms of security, which is often used to reflect internal problems within the network.

[0096] Preferably, the business data includes the relationships between basic data stored in advance in the form of business data tables, as well as pre-set rules for obtaining derived features.

[0097] Taking vulnerability as an example, the pre-set rules for obtaining derived features include the artificial definition rules for important indicators such as vulnerability indicators and impact factor indicators.

[0098] For example, regarding vulnerability, this indicator primarily targets abnormal operation control, mainly considering features obtained through original data collection or indirect deduction reflected in the knowledge graph, such as physical environment, data flow, deployment area of ​​interactive systems, and system operation. The physical environment mainly refers to the operating environment of the external systems interacting with it, primarily including standalone systems, cloud platforms, and container deployments. Data flow mainly includes receiving data and sending data. The deployment area of ​​the interactive system mainly refers to the deployment location of the interactive system, with values ​​of being located in Zone 2, Zone 3, or Zone 4. System operation refers to whether data generation is automatically run in the system background or manually triggered by business personnel. The interactive system mentioned here refers to the internal business system of the distributed power scheduling and control network in this invention, while the external systems interacting with it are the systems where other businesses reside.

[0099] All of the above metrics exist as nodes in the knowledge graph constructed in the preceding steps. Based on the actual value of the above nodes corresponding to each traffic data point, the value of the vulnerability endpoint can be deduced.

[0100] Preferably, the vulnerability level and vulnerability assessment quantity of traffic data are deduced by analyzing the business flow, physical environment, and data processing method of traffic data. This includes: analyzing the business flow type, physical environment type, and data processing method type of traffic data, and assigning attribute values ​​to each different type; using the attribute values ​​of the business flow type, physical environment type, and data processing method type of traffic data to perform permutations and combinations to obtain the vulnerability level of traffic data; and performing a weighted summation of the attribute values ​​of the business flow type, physical environment type, and data processing method type of traffic data to obtain the vulnerability assessment quantity of traffic data.

[0101] Table 1 shows the classification rules for a vulnerability index in this invention. As shown in Table 1, when the system operation, physical environment, data flow, and system deployment area are different, the vulnerability can be divided into 36 different vulnerability levels through the above sub-attributes.

[0102]

[0103]

[0104] Table 1 Classification Rules for Vulnerability Indicators

[0105] In addition to obtaining the vulnerability level, this invention also supports the calculation of the vulnerability assessment quantity. In one embodiment, the vulnerability assessment quantity is a weighted sum of sub-attribute values ​​such as system operation, physical environment, data flow, and deployment area of ​​the interactive system, under different weights. For example:

[0106] Vulnerability assessment amount = System operation * 10% + Physical environment * 30% + Data flow * 30% + Interactive system deployment area * 30%.

[0107] Figure 3 This is a schematic diagram illustrating the vulnerability feature deduction path in an abnormal behavior detection method adapted to distributed power scheduling and control networks according to the present invention. Figure 3 As shown, firstly, the destination system name is found through the mapping table between the destination address's IP address and the destination system name. Then, the geographical region of the destination address is determined, and further, the security zone of the destination system is obtained. Similarly, the source system name is found based on the mapping table between the source IP address and the source system name. Then, the geographical region of the source is found based on the attribution relationship. Finally, the security zone of the source system is obtained through the mapping table between the geographical region and the security zone.

[0108] The direction of data flow can be determined based on the source and destination security zones. In one embodiment, the data flow is either sending or receiving data. In other embodiments, the data flow can be from one specific system to another. Based on the actual data flow, a comprehensive analysis of vulnerability characteristics can be obtained.

[0109] Furthermore, the device's IP address reveals its location, which in turn determines the required physical environment of the system within the device—whether it's a cloud environment, container environment, or standalone environment. Finally, the data's type allows us to determine its specific business category, which in turn leads to the business classification. The relationship between this business classification and its data processing method reveals the processing method for that category of data, such as whether it's manually triggered or automatically processed in the background. Therefore, by analyzing the values ​​of these various sub-attributes, we can deduce the vulnerability characteristics of a given traffic data point.

[0110] The preferred model for inferring the characteristics of the influencing factors is as follows: using the data content related to each piece of traffic data in the security audit data corresponding to the traffic data, the alarm information of the traffic data is extracted; the alarm level of the alarm information is inferred using the alarm information; the business data interaction range of the traffic data is inferred using the alarm information; and the influencing factors of the traffic data are inferred through the data flow direction of the traffic data, the business data interaction range, and the alarm level of the alarm information.

[0111] Similarly, the business data also includes predefined rules for classifying the levels of impact factors. These impact factors primarily characterize the degree to which traffic data affects the normal operation of distributed power dispatch and control services. Table 2 presents these classification rules.

[0112]

[0113] Table 2. Rules for Determining Impact Factor Levels

[0114] The scheduling system and interaction system mentioned in the table above refer to the distributed power dispatching and control network of this invention. When this network interacts with other external systems to exchange traffic data, it is called an interaction system. If traffic data is only transmitted between different devices within the network, it is called a scheduling system. External systems refer to systems that provide other external services. The traffic data, security audit data, and service data extracted in this invention are obtained from the communication process between the internal scheduling system, interaction system, and external systems. Due to the continuous expansion of external services and systems, the original distributed power dispatching and control network has received support from third parties, expanding data application methods and enriching the dispatching and control process.

[0115] Figure 4 This is a schematic diagram illustrating the derivation path of influencing factor characteristics in an abnormal behavior detection method adapted to distributed power scheduling and control networks according to the present invention. For example... Figure 4 As shown, firstly, the source system name is found based on the mapping between the source IP address and the source system name. Then, the source region is found based on the attribution relationship. The security zone of the source system is obtained through the mapping between the region and the security zone. The data flow direction can be obtained based on the source security zone and the destination security zone. This part is similar to the reasoning process of vulnerability indicators.

[0116] Furthermore, the alarm level can be determined based on the alarm information, i.e., critical alarm or general alarm. Finally, the alarm information can be used to determine the alarm category, thereby identifying the business data type of the alarm and ultimately the interaction scope of the business data that generated the alarm, i.e., whether it is internal system interaction, interaction with external systems in security zone IV, interaction with external systems deployed in security zone III, or interaction with external systems in security zone II.

[0117] Preferably, the impact factors of traffic data are deduced by the data flow direction of traffic data, the scope of business data interaction, and the alarm level of alarm information, including: the evaluation quantity of the impact factors of traffic data is deduced based on the pre-set impact level rules.

[0118] Based on the above three attributes and the rules in Table 2, the characteristic values ​​of the impact factor can also be obtained: internal system interaction plus general alarms result in a very low impact factor; internal system interaction plus severe alarms result in a low impact factor; interaction with external systems in the same security zone IV plus general alarms result in a low impact factor; interaction with external systems in the same security zone IV plus severe alarms result in a medium impact factor; interaction with external systems in the same security zone III plus either general or severe alarms result in a high impact factor; and interaction with external systems in security zone II results in a very high impact factor, regardless of whether it is a general alarm or a severe alarm.

[0119] Using a similar approach, we obtained the classification of influencing factors for each traffic data point.

[0120] In addition to simplifying derived features using the SVM algorithm employed in this invention, the invention also supports an expert verification process for each derived feature, thereby optimizing the rules for formulating individual derived features. For example, business experts use verified historical data to perform regression verification on the fused and deduced features, analyzing whether the derived features and feature values ​​meet expectations. Through extensive verification with historical data, inappropriate feature values ​​are redefined or adjusted, ultimately yielding the most suitable features and corresponding feature values, which updates the rules in Table 2 and obtains the optimal feature solving method.

[0121] Step 3: Construct an input dataset using traffic data, security audit data, and derived data features. Input the input dataset into the gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network.

[0122] In this invention, three new feature values, verified and extracted, are combined with the original feature values ​​to form a new threat analysis data set with time information and original features, serving as the feature attributes of the decision tree. By constructing the input dataset for the decision tree, a pre-trained anomaly classification model can be generated.

[0123] This invention employs a machine learning algorithm based on the Gradient Boosting Decision Tree (GBDT) framework. First, it proposes replacing the values ​​of the categorical features with the average label values ​​corresponding to those features, effectively transforming each measurement type in the power system into a numerical feature. This allows for efficient and automatic handling of the influence of categorical features. These features correspond to a key node in the knowledge graph, including not only the originally collected data but also the data corresponding to derived feature nodes.

[0124] Preferably, an input dataset is constructed using traffic data, security audit data, and derived data features. This input dataset is then fed into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling control network. This includes: randomly sorting the input dataset to obtain multiple measurement sample vectors; for the current sample among the multiple measurement sample vectors, adjusting multiple feature values ​​in the measurement sample vector of the current sample using the prior samples of each current sample, the probability distribution function of the feature values ​​of the current sample, and the prior label of the current sample to generate a new measurement sample vector; and constructing a new input dataset based on the multiple new measurement sample vectors and feeding it into the gradient boosting decision tree model.

[0125] When processing categorical features, the input dataset D = {X} i ,yi Randomly sort the i (i = 1, 2, ..., n) groups. Where X... i =(x i,1 ,x i,2 ,…,x i,m The vector represents a power system measurement sample with m features, which can be obtained for each different flow monitoring data in this invention. i ∈R, which is the pre-classification label of the input dataset, and also the final data type label after the model is generated.

[0126] Figure 5 This is a schematic diagram summarizing the classification of common abnormal events in the abnormal behavior detection method adapted to distributed power scheduling and control networks of the present invention. For example... Figure 5 As shown, depending on the operating status of the power system, when the power system operates in an abnormal state, it may be caused by natural anomalies or attack anomalies. Natural anomalies include short-circuit faults, commutation failures, frequency instability, and line maintenance. In one embodiment of this invention, these natural anomalies are not the target of the abnormal behavior detection of this invention, but are considered non-threatening alarms or merely potential prerequisites for triggering abnormal behavior. Attack anomalies include various abnormal attack behaviors such as command injection, data injection, and setting changes. After excluding natural anomalies of the power system, the fundamental purpose of this invention is to effectively and accurately obtain anomaly behavior classification from the flow data. Therefore, the classification label Y of the input dataset... i It is also configured to address various abnormal attack behaviors such as command injection, data injection, and setting changes.

[0127] After randomly sorting the input dataset, the resulting sorted sequence is σ = {σ(1), σ(2), ..., σ(n)}. Here, x represents the k-th feature value of the σ(j)-th sample. σ(j),k Represented as:

[0128]

[0129] like

[0130] In the formula, Y σ(j) Let σ(j) be the prior label value corresponding to the classification label of the current sample, p be the number of samples in the added prior distribution term, the last one be the current sample, and a be the weight coefficient with a>0, for example, determined by the percentage of the current label sample in the total number of samples. P[·] is the probability distribution function of the feature value of the current sample, therefore P[x σ(i),k =x σ(p),k [x] represents the last feature value in the prior samples, i.e., the feature value of sample σ(j). σ(p),k The probability equal to the feature value of any sample i in the prior samples of this class. This is used to sum the probabilities of feature similarity between the current sample and multiple prior samples.

[0131] After selecting an appropriate weighting coefficient 'a' The value of x is relatively small, thus ensuring that the feature value x of the current sample is small. σ(p),k In its own tag Y σ(j) The label value fluctuates around the value.

[0132] The above formula can be used to convert the values ​​of categorical features into the average label values ​​corresponding to the categorical features. In other words, each measurement type of the power system is converted into a numerical feature value, which is similar to a normalization process. This makes it easier to efficiently and automatically handle the influence of categorical features.

[0133] The gradient boosting decision tree model described above comprises multiple decision trees. Each decision tree in the model is a weak learner, which can be optimized by minimizing the multi-class cross-entropy loss function. The loss function can be expressed as:

[0134]

[0135] In the formula, N is the number of samples, K is the number of categories, and y i,k For the true label of the sample, The classification results labels for the model are obtained by classifying sample i into the k-th class.

[0136] However, for certain specific datasets or problems, such as anomaly detection tasks in complex distributed power regulation data, the basic model still requires further parameter tuning to achieve optimal performance. Otherwise, the model's performance may be affected by parameters such as tree depth and learning rate. Therefore, further optimization based on the basic model is necessary to meet business and performance requirements.

[0137] Preferably, an input dataset is constructed using traffic data, security audit data, and derived data features. This input dataset is then fed into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network. This includes selecting multiple hyperparameters to be optimized from the gradient boosting decision tree, minimizing the cross-entropy loss of the decision tree, and using the Grey Wolf algorithm to optimize the multiple hyperparameters.

[0138] Model parameters involved in optimization may include the maximum number of iterations for the decision tree, the learning rate, the tree split depth, and the L2 regularization parameter. In the default model, the number of iterations is 1000, the learning rate is 0.03, the tree split depth is 6, and the L2 regularization parameter is 3.0. This invention optimizes the above parameters and other parameters using the Grey Wolf algorithm.

[0139] First, taking the basic detection model as the objective function, which includes key model parameters such as the maximum number of trees, the learning rate, and the tree depth, the cost of the objective function can be expressed as:

[0140]

[0141] In the formula,

[0142] Initialize the positions and target groups to be analyzed. First, determine multiple candidate schemes θ. i The position vector to be selected can be obtained by randomly generating an initial population, and the candidate solution set can be represented as:

[0143]

[0144] In the formula, N is the total number of candidate solutions in the search space. Let be the j-th decision variable of the i-th parameter candidate in the basic model. Using a stochastic initialization process to identify the initial positions of these vectors in the search space, we have:

[0145]

[0146] In the formula, Let $\mathbf{i}$ be the maximum and minimum boundaries of the $j$-th decision variable for the $i$-th candidate parameter.

[0147] Next, the initial globally optimal parameter scheme is selected as the master GB, and the better candidate schemes of the basic model parameters are selected as the deep optimization filter, which can be represented as FH=[FH1,FH2,…,FHl,…,FH n ], where l = 1, 2, ..., n. Selecting the remaining candidate solutions as the target for this screening can be expressed as PR = [PR1, PR2, ..., PRn]. l ,…,PR n (k = 1, 2, ..., n).

[0148] Finally, based on the rules, the set of clusters of the targets to be filtered is defined as the safe zone. Therefore, the safe zone SP within the domain of the dataset to be filtered is defined. l The safe zone SP within the search space is represented as:

[0149]

[0150] In the formula, PR q For the l-th target in the field to be screened this time, PR k This represents the k-th target to be filtered in the entire search space.

[0151] The simulation filtering process updates the dataset. First, the filtering range of this filter and the anomalies within that range are determined, and the FH is calculated using Euclidean distance. l and PR k Distance between It can be represented as:

[0152]

[0153] Where (x1,y1) and (x2,y2) are the filters FH respectively. l and abnormal PR k The coordinates in the search space. Then, the position update of the filter during the search process can be represented as:

[0154]

[0155] Here, r1 and r2 are random numbers uniformly distributed within the range (0,1), used to determine the movement of the filter towards the primary target domain and other filter domains. Finally, the position update of the filter during the search process can be expressed as:

[0156]

[0157] Here, r3 and r4 are random numbers uniformly distributed within the range (0,1), used to determine the movement of anomalies towards safe areas. Simultaneously, anomalies may also escape to other areas outside the initial domain, or even attempt to hide in safer regions. Based on these behaviors, the position update during the search process can be represented as:

[0158]

[0159] Among them, r5 and r6 are random numbers uniformly distributed in the range (0,1), used to determine the movement of anomalies to safe areas outside other areas.

[0160] The algorithm iteratively updates the global optimum. After each iteration, it checks if any abnormal update position can yield a smaller objective function cost. If so, it updates the global optimum GB and continues iterating. When the algorithm reaches the termination condition (maximum number of iterations or other conditions), it ends the current optimization process and outputs the global optimum θ. best and its corresponding objective function optimal cost value θ best .

[0161] Deep optimization screening models, by combining deep optimization algorithms with a basic model, can optimize the model's hyperparameters during training, making it more flexible in adapting to the characteristics of specific data. Trained deep optimization screening models possess more efficient response detection capabilities, thus capturing anomalous events more quickly and responding rapidly in real-time monitoring environments.

[0162] Step 4: Monitor the current traffic status in the distributed power scheduling and control network, use the abnormal behavior classification model to obtain the current abnormal behavior of the current traffic status, and implement abnormal event response based on the current abnormal behavior.

[0163] Figure 6 This is a schematic diagram of the abnormal event detection process in an abnormal behavior detection method adapted to distributed power scheduling and control networks according to the present invention. In the above process, to improve the accuracy of the basic algorithm in abnormal event detection, the overall detection process of the deep optimization filter abnormal event detection model is as follows: Figure 6 As shown.

[0164] like Figure 6 During the training phase, firstly, the basic model is defined as the objective function, and its main parameters and search range are determined. Its loss rate on the validation set is defined as the cost value. Then, a deep optimization algorithm is used to optimize the parameters of the basic model. The population size and maximum number of iterations for the deep optimization algorithm are initialized. Through a deep optimization training loop, a better solution is sought based on the calculated cost value of the basic model on the training set. The optimization process ends after the maximum iteration condition is met, returning the globally optimal solution and its cost value, thus obtaining the optimal parameter configuration for the deep-optimized screening and detection model.

[0165] In the detection phase, firstly, a deep optimization screening and detection model is constructed using the optimal parameter configuration obtained through training. Then, the model's detection of test data and the identification of abnormal events assist the power system in implementing corresponding response measures.

[0166] Preferably, the current traffic status in the distributed power dispatch control network is monitored, the current abnormal behavior of the current traffic status is obtained using an abnormal behavior classification model, and an abnormal event response is implemented based on the current abnormal behavior, including: providing an abnormal event response method for each abnormal behavior type in the abnormal behavior classification model; and selecting the corresponding abnormal event response method to respond to the current traffic status abnormally for the abnormal behavior type of the current abnormal behavior.

[0167] Using the above method, this invention obtains the types of abnormal events, such as command injection, data injection, and setting changes. After further analyzing the traffic monitoring data corresponding to the abnormal events, it is also possible to target and eliminate or regulate current security threats based on the anomaly type, thereby enabling the distributed power scheduling and control network to acquire covert attack resistance capabilities and ensure network security.

[0168] A second aspect of this invention relates to an abnormal behavior detection system adapted to a distributed power scheduling and control network. The system is implemented using an abnormal behavior detection method adapted to a distributed power scheduling and control network as described in the first aspect of this invention. The system includes a capture module, a deduction module, a classification module, and a response module. The capture module is used to capture traffic data from the distributed power scheduling and control network using a traffic monitoring method and to collect security audit data from the distributed power scheduling and control network. The deduction module is used to use a knowledge graph to analyze the correlation between the traffic data and the security audit data, and to obtain derived feature data in the distributed power scheduling and control network. The classification module is used to construct an input dataset using the traffic data, security audit data, and derived data features, and input the input dataset into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network. The response module is used to monitor the current traffic state in the distributed power scheduling and control network, obtain the current abnormal behavior of the current traffic state using the abnormal behavior classification model, and implement an abnormal event response based on the current abnormal behavior.

[0169] A third aspect of the present invention relates to a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to perform the steps of the method according to the first aspect of the present invention.

[0170] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method of the first aspect of the present invention.

[0171] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for detecting abnormal behavior in distributed power dispatch and control networks, characterized in that, The method includes the following steps: Traffic data is captured from the distributed power scheduling and control network using a traffic monitoring method, and security audit data of the distributed power scheduling and control network is collected. The correlation between the traffic data and the security audit data is analyzed by using knowledge graphs, and derived feature data in the distributed power scheduling and control network is obtained. The data dimensions in the derived feature data include open service features, vulnerability features, and impact factor features; The deduction model for the open service feature is as follows: using the destination IP address in the traffic data, the name of the destination system that corresponds to the destination IP address is deduced; Using the destination system name, deduce the destination domain to which the destination system name belongs; Using the destination domain, a destination security zone that corresponds to the destination domain can be deduced; Using the target security zone, deduce the open service level to which the target security zone belongs; The mapping relationship between the destination IP address and the destination system name, the attribution relationship between the destination system name and the destination domain, the mapping relationship between the destination domain and the destination security zone, and the attribution relationship between the destination security zone and the open service level are pre-stored in the deduction model of the open service characteristics in the form of a business data table; The vulnerability feature deduction model is as follows: using the destination IP address and source IP address in the traffic data, the destination security zone and source security zone of the traffic data are deduced respectively; The service flow direction of the traffic data is inferred based on the destination security zone and the source security zone; The physical environment of the traffic data can be deduced using the device ID in the traffic data. The data processing method for the traffic data can be deduced based on the business data type of the traffic data. By analyzing the business flow, physical environment, and data processing methods of the traffic data, the vulnerability level and vulnerability assessment value of the traffic data can be deduced. The deduction model for the characteristics of the influencing factors is as follows: using the data content related to each piece of traffic data in the security audit data corresponding to the traffic data, the alarm information of the traffic data is extracted; The alarm level of the alarm information can be deduced using the alarm information; The alarm information is used to deduce the scope of business data interaction of the traffic data; By analyzing the data flow direction of the traffic data, the scope of the business data interaction, and the alarm level of the alarm information, the influencing factors of the traffic data can be deduced. An input dataset is constructed using the traffic data, security audit data, and derived data features. This input dataset is then fed into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network. Monitor the current traffic status in the distributed power scheduling and control network, use the abnormal behavior classification model to obtain the current abnormal behavior of the current traffic status, and implement abnormal event response based on the current abnormal behavior.

2. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 1, characterized in that: The method of capturing traffic data from the distributed power dispatch control network through traffic monitoring includes: The traffic data includes sending time, receiving time, source IP address, destination IP address, network hop node IP, number of network hop nodes, data packet size, data flow direction, time of the last received data packet, time of the last sent data packet, source port, destination port, total number of uplink and downlink data packets, total number of uplink and downlink payloads, total uplink and downlink load, traffic duration, average load, maximum and minimum load, average time interval between uplink and downlink data packets, minimum time interval, and maximum time interval between uplink and downlink.

3. The abnormal behavior detection method adapted to distributed power dispatching and control networks according to claim 2, characterized in that: The collection of security audit data from the distributed power scheduling and control network includes: The security audit data includes data security alarms, operational security alarms, device security alarms, database security checks, data operation logs, business operation logs, audit logs, alarm levels, and open service records.

4. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 3, characterized in that: The step of using knowledge graphs to infer and analyze the correlation between the traffic data and the security audit data, and obtaining derived feature data in the distributed power scheduling and control network, includes: For each of the aforementioned traffic data, the data content related to each of the aforementioned traffic data in the security audit data is obtained by using knowledge graph inference; Based on the traffic data and the data content related to each piece of traffic data in the security audit data, the derived feature data corresponding to each piece of traffic data is deduced.

5. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 4, characterized in that: The step of deriving the derived feature data corresponding to each piece of traffic data based on the traffic data and the data content related to each piece of traffic data in the security audit data includes: The knowledge graph is used to construct a deduction model for each data dimension in the derived feature data, and traffic data, security audit data and business data at different times are assigned to the deduction model to obtain the value of each data dimension.

6. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 1, characterized in that: The process of deriving the vulnerability level and vulnerability assessment value of the traffic data based on the business flow, physical environment, and data processing method of the traffic data includes: Analyze the business flow type, physical environment type, and data processing method type of the traffic data, and assign attribute values ​​to each different type; The vulnerability level of the traffic data is obtained by arranging and combining the attribute values ​​of the traffic data's business flow type, physical environment type, and data processing method type. The vulnerability assessment value of the traffic data is obtained by weighted summing of the attribute values ​​of the business flow type, physical environment type, and data processing method type.

7. The abnormal behavior detection method adapted to distributed power dispatching and control networks according to claim 1, characterized in that: The factors influencing the traffic data are deduced from the data flow direction of the traffic data, the scope of business data interaction, and the alarm level of the alarm information, including: The evaluation value of the impact factor of the traffic data is derived based on the pre-set impact level rules.

8. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 1, characterized in that: The step of using knowledge graphs to infer and analyze the correlation between the traffic data and the security audit data, and obtaining derived feature data in the distributed power scheduling and control network, includes: The knowledge graph is used to deduce and analyze all the correspondences and attributions between the traffic data, the security audit data, and the business data, and to generate a basic knowledge graph. The deductive process is traversed from the basic knowledge graph to obtain all derived features of the basic knowledge graph; The SVM algorithm is used to extract multiple optimal derived features from all derived features, and these optimal derived features are then used to simplify the basic knowledge graph.

9. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 8, characterized in that: The business data includes the relationships between basic data stored in advance in the form of business data tables, as well as pre-set rules for obtaining derived features.

10. A method for detecting abnormal behavior in a distributed power dispatch control network according to any one of claims 1-9, characterized in that: The step of constructing an input dataset using the traffic data, security audit data, and derived data features, and then inputting the input dataset into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network includes: Multiple hyperparameters to be optimized are selected from the gradient boosting decision tree. With the goal of minimizing the cross-entropy loss of the decision tree, the Grey Wolf algorithm is used to optimize the multiple hyperparameters to be optimized.

11. The abnormal behavior detection method adapted to distributed power scheduling and control networks according to claim 10, characterized in that: The step of constructing an input dataset using the traffic data, security audit data, and derived data features, and then inputting the input dataset into a gradient boosting decision tree model to obtain an abnormal behavior classification model for the distributed power scheduling and control network includes: The input dataset is randomly sorted to obtain multiple measurement sample vectors; For the current sample among the multiple measurement sample vectors, multiple feature values ​​in the measurement sample vector of the current sample are adjusted using the prior sample of each current sample, the probability distribution function of the feature value of the current sample, and the prior label of the current sample to generate a new measurement sample vector; A new input dataset is constructed based on multiple new measurement sample vectors and input into the gradient boosting decision tree model.

12. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 11, characterized in that: The step of adjusting multiple feature values ​​in the measurement sample vector of the current sample among the multiple measurement sample vectors, using the prior samples of each current sample, the probability distribution function of the feature values ​​of the current sample, and the prior label of the current sample, to generate a new measurement sample vector, includes: No. The k-th feature value of a sample Represented as: In the formula, For the current sample The prior label value corresponding to the category label. The number of samples in the added prior distribution term. These are the weighting coefficients. Let be the probability distribution function of the feature values ​​of the current sample. The The feature values ​​are The feature value of the prior sample is .

13. The abnormal behavior detection method adapted to distributed power dispatch control networks according to claim 12, characterized in that: The process of monitoring the current traffic status in the distributed power scheduling and control network, obtaining the current abnormal behavior of the current traffic status using the abnormal behavior classification model, and implementing abnormal event response based on the current abnormal behavior includes: Provide an abnormal event response method for each abnormal behavior type in the abnormal behavior classification model; For each abnormal behavior type of the current abnormal behavior, select the corresponding abnormal event response method to respond to the abnormality of the current traffic status.

14. An abnormal behavior detection system adapted to distributed power dispatch control networks, characterized in that: The system is implemented using an abnormal behavior detection method adapted to a distributed power dispatch control network as described in any one of claims 1-13; and... The system includes a capture module, a deduction module, a classification module, and a response module; wherein, The capture module is used to capture traffic data from the distributed power scheduling and control network through a traffic monitoring method, and to collect security audit data of the distributed power scheduling and control network. The inference module is used to use knowledge graphs to infer and analyze the correlation between the traffic data and the security audit data, and to obtain derived feature data in the distributed power scheduling and control network. The data dimensions in the derived feature data include open service features, vulnerability features, and impact factor features; The deduction model for the open service feature is as follows: using the destination IP address in the traffic data, the name of the destination system that corresponds to the destination IP address is deduced; Using the destination system name, deduce the destination domain to which the destination system name belongs; Using the destination domain, a destination security zone that corresponds to the destination domain can be deduced; Using the target security zone, deduce the open service level to which the target security zone belongs; The mapping relationship between the destination IP address and the destination system name, the attribution relationship between the destination system name and the destination domain, the mapping relationship between the destination domain and the destination security zone, and the attribution relationship between the destination security zone and the open service level are pre-stored in the deduction model of the open service characteristics in the form of a business data table; The vulnerability feature deduction model is as follows: using the destination IP address and source IP address in the traffic data, the destination security zone and source security zone of the traffic data are deduced respectively; The service flow direction of the traffic data is inferred based on the destination security zone and the source security zone; The physical environment of the traffic data can be deduced using the device ID in the traffic data. The data processing method for the traffic data can be deduced based on the business data type of the traffic data. By analyzing the business flow, physical environment, and data processing methods of the traffic data, the vulnerability level and vulnerability assessment value of the traffic data can be deduced. The deduction model for the characteristics of the influencing factors is as follows: using the data content related to each piece of traffic data in the security audit data corresponding to the traffic data, the alarm information of the traffic data is extracted; The alarm level of the alarm information can be deduced using the alarm information; The alarm information is used to deduce the scope of business data interaction of the traffic data; By analyzing the data flow direction of the traffic data, the scope of the business data interaction, and the alarm level of the alarm information, the influencing factors of the traffic data can be deduced. The classification module is used to construct an input dataset using the traffic data, security audit data, and derived data features, and input the input dataset into the gradient boosting decision tree model to obtain an abnormal behavior classification model of the distributed power scheduling control network. The response module is used to monitor the current traffic status in the distributed power scheduling and control network, obtain the current abnormal behavior of the current traffic status using the abnormal behavior classification model, and implement an abnormal event response based on the current abnormal behavior.

15. A terminal, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method according to any one of claims 1-13.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program implements the steps of the method according to any one of claims 1-13.

Images