An intelligent defense method for network attacks based on collaboration between large and small models

Abstract

The present invention relates to the field of information transmission, and discloses a network attack intelligent defense method based on the collaboration of large and small models, including: by obtaining the total number of nodes and the maximum depth corresponding to the network topology structure diagram, the smart grid system is divided to obtain multiple smart grid subsystems, according to the function and coverage of the smart grid subsystem, the detection threshold interval corresponding to each smart grid subsystem is determined, and multiple measurement values ​​of the smart grid subsystem are detected by the large and small models to obtain the attack risk detection result, and generate the protection instruction for the protection equipment. Thereby, the accuracy of the detection result is improved, and the defense effect against network attacks is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information transmission, and in particular to an intelligent network attack defense method based on collaboration of large and small models. Background Art

[0002] The power system is a typical cyber physical system (CPS). Various attacks on the power system are emerging one after another. Attackers control various devices in the power system by installing malware, thereby causing damage to the power system. Therefore, information security risks have become an important factor affecting the safe and stable operation of the power system. Existing defense methods are often detected through the largest normalized residual (LNR) method, mutation detection method, and other methods.

[0003] Existing network attack defense methods often have the following technical problems:

[0004] First, methods such as the maximum standard residual method and the mutation detection method detect risks indiscriminately, and the detection results are inaccurate;

[0005] Second, the existing small models are obtained by splitting the large model, which will split a large number of small models and lack a small model screening mechanism;

[0006] Third, existing defense methods generally conduct targeted defense when intrusion risks are detected, and lack an early prevention mechanism. Summary of the invention

[0007] The summary of the invention is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The summary of the invention is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0008] The present invention proposes a network attack intelligent defense method based on the collaboration of large and small models to solve one or more of the technical problems mentioned in the above background technology part.

[0009] The present invention provides a network attack intelligent defense method based on large and small model collaboration, comprising:

[0010] Deploy a large model in the cloud and deploy small models in the master nodes in the target area. Each master node is connected to the cloud.

[0011] Obtain a network topology structure diagram corresponding to the smart grid system in the target area, the network topology structure diagram including multiple nodes; determine the total number of nodes and the maximum depth corresponding to the network topology structure diagram; if the total number of nodes is greater than a preset node threshold and the maximum depth is greater than the preset node threshold, divide the smart grid system according to the network topology structure diagram to obtain multiple smart grid subsystems and a network topology structure subgraph corresponding to each smart grid subsystem; for each smart grid subsystem, determine the detection threshold interval corresponding to each smart grid subsystem according to the function and coverage of the smart grid subsystem, and store the detection threshold interval corresponding to each smart grid subsystem in the master station node, the detection threshold interval including an upper detection threshold value and a lower detection threshold value;

[0012] For each smart grid subsystem, multiple measurement values ​​of the smart grid subsystem are obtained, and the multiple measurement values ​​are sent to the master station node, so that the master station node constructs a first measurement feature according to the multiple measurement values, and the first measurement feature is input into the small model to obtain a first attack probability corresponding to the smart grid subsystem, and the first attack probability is compared with the detection threshold corresponding to the smart grid subsystem. If the first attack probability is less than or equal to the lower limit value of the detection threshold, a prompt message indicating that there is no attack risk is generated; if the first attack probability is greater than the upper limit value of the detection threshold corresponding to the smart grid subsystem, a protection instruction for the protection device is generated;

[0013] If the first attack probability is less than or equal to the upper limit value of the detection threshold and greater than the lower limit value of the detection threshold, multiple measurement values ​​are sent to the cloud so that the cloud constructs a second measurement feature based on the multiple measurement values, and inputs the second measurement feature into the large model to obtain the second attack probability, and compares the second attack probability with the intermediate detection threshold to obtain the attack risk detection result, wherein the intermediate detection threshold is generated based on the upper limit value of the detection threshold and the lower limit value of the detection threshold.

[0014] Optionally, a small model is generated by following the steps below:

[0015] Obtain a pre-configured small model parameter range, slice the large model according to the small model parameter range, and obtain multiple slice models, where the parameter of each slice model meets the small model parameter range;

[0016] For each test sample in the test sample set, the test sample is input into the large model and each slice model in the multiple slice models, and the attack probability output by the large model is determined as the benchmark attack probability, and the attack probability output by each slice model is determined as the actual attack probability, and the difference between each actual attack probability and the benchmark attack probability is calculated respectively to obtain the probability difference of each slice model; the multiple slice models are sorted in order of the probability difference from small to large to obtain the slice model sequence corresponding to each test sample;

[0017] According to the order of probability difference from small to large, a target number of slice models are selected from the slice model sequence corresponding to each test sample as candidate slice models, and the candidate slice models corresponding to each test sample in the test sample set constitute a candidate slice model set; for the candidate slice models in the candidate slice model set that appear more than or equal to twice, they are determined as seed slice models, and the number of occurrences corresponding to each seed slice model is counted; multiple seed slice models are sorted in the order of the number of occurrences from large to small to obtain a seed slice model sequence;

[0018] Determine whether the resource requirement of the first seed slice model in the seed slice model sequence matches the resource configuration of the master node. If not, continue to determine whether the resource requirement of the next seed slice model in the seed slice model sequence matches the resource configuration of the master node until a seed slice model that matches the resource configuration of the master node appears, and determine the matching seed slice model as a candidate small model;

[0019] The candidate small models are trained using the training sample set of the smart grid system to obtain the small model of the master station node.

[0020] Optionally, a network attack intelligent defense method based on large and small model collaboration of the present invention further includes:

[0021] If the attack risk detection result indicates that there is an attack risk, access control information for the protection device is generated, so that the protection device performs access control on the smart grid subsystem according to the access control information.

[0022] Optionally, access control information is generated according to the following steps:

[0023] A smart grid subsystem with attack risks is determined as a target smart grid subsystem, and multiple importance influencing factors of the target smart grid subsystem are obtained, where the multiple importance influencing factors include the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area; an importance coefficient is generated according to the multiple importance influencing factors and the weight corresponding to each importance influencing factor;

[0024] According to the importance coefficient, the corresponding access control information is queried from the pre-configured access control list.

[0025] Optionally, obtain multiple measurements of smart grid subsystems, including:

[0026] According to the network topology diagram corresponding to the smart grid system, multiple nodes are grouped to obtain a device node group, a communication node group and a master station node group;

[0027] For the communication node group, according to the type of node to which each communication node is connected, the communication node group is divided into a communication leaf node group, a communication intermediate node group and a communication root node group, wherein the communication leaf nodes in the communication leaf node group are directly connected to the power distribution device nodes, and the communication root nodes in the communication root node group are directly connected to the master station nodes;

[0028] According to a preset node extraction ratio, nodes are extracted from the device node group, the communication leaf node group, the communication intermediate node group, and the communication root node group to obtain a plurality of extracted node groups, the plurality of extracted node groups including an extracted device node group, an extracted communication leaf node group, an extracted communication intermediate node group, and an extracted communication root node group;

[0029] Obtain a measurement indicator configuration table, and extract measurement indicators corresponding to each extracted node group from the measurement indicator configuration table;

[0030] According to the measurement index corresponding to each extracted node group, the measurement value corresponding to the measurement index of each node in each extracted node group is obtained to obtain the measurement value group of each extracted node group; according to the measurement value groups corresponding to each extracted node group, multiple measurement values ​​of the smart grid subsystem are generated.

[0031] The present invention has the following beneficial effects:

[0032] 1. Improved the defense effect against network attacks. Specifically, a corresponding detection threshold interval is set for each smart grid subsystem to achieve targeted network attack defense. In practice, different smart grid subsystems have different measurement values ​​when attacked. If the same detection threshold is set, the generated detection results will be inaccurate. Therefore, the detection threshold interval is set in a targeted manner, thereby improving the accuracy of the detection results and the defense effect against network attacks. In addition, the attack risks are screened through small models, and the attack risks that are difficult to judge by small models are calculated using large models, thereby improving the accuracy of the detection results.

[0033] 2. Improve the accuracy of small models. Specifically, the probability difference between each small model and the large model is calculated to improve the accuracy of the small model. In practice, the smaller the probability difference, the higher the accuracy of the small model. Therefore, the accuracy of the small model is improved through the probability difference.

[0034] 3. Improved the defense capability of smart grid subsystems. Specifically, the detection threshold intervals of similar smart grid subsystems are updated to achieve early prevention of the same type of network attacks. In practice, similar smart grid subsystems have similar structures and are subject to the same type of network attacks. After a smart grid subsystem is attacked, the detection threshold intervals of similar smart grid subsystems are updated, thereby improving the defense capability of similar smart grid subsystems and achieving early prevention of the same type of network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0036] Figure 1 It is a flow chart of a network attack intelligent defense method based on collaboration of large and small models of the present invention. DETAILED DESCRIPTION

[0037] The present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0038] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0039] It should be noted that the concepts such as "first" and "second" mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0040] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0041] The names of the messages or information exchanged between multiple devices of the present invention are only for illustrative purposes, and are not used to limit the scope of these messages or information.

[0042] The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0043] like Figure 1 As shown, a flow chart of a network attack intelligent defense method based on large and small model collaboration of the present invention is shown, which specifically includes the following steps:

[0044] Step 101, deploy a large model in the cloud, and deploy a small model in the master station node in the target area, and each master station node is connected to the cloud for communication.

[0045] In some embodiments, the execution subject of the network attack intelligent defense method based on large and small model collaboration of the present invention can be a server side, which can be a desktop computer or a laptop computer.

[0046] In practice, a large model is a model with large-scale parameters and complex computing structures, with parameters in the billions. A small model is a model with smaller parameters and shallower layers, with parameters in the millions. For example, a large model can be GPT-4, Llama-13B, and a small model can be DCLM-7B, Mistral NeMo. On this basis, a large model is deployed in the cloud, and a small model is deployed in the master node in the target area. Each master node is connected to the cloud through various communication methods. The cloud is a software platform based on application virtualization technology. The target area can be any area managed by the server. The master station refers to a data station in the basic mode link control that transmits data to one or more slave stations after receiving a request. The master node is the central node of the basic mode link control, and each master station corresponds to a master node. The target area contains multiple master nodes.

[0047] Step 102, obtaining a network topology structure diagram corresponding to the smart grid system in the target area, the network topology structure diagram including multiple nodes; determining the total number of nodes and the maximum depth corresponding to the network topology structure diagram; if the total number of nodes is greater than a preset node threshold and the maximum depth is greater than the preset node threshold, dividing the smart grid system according to the network topology structure diagram to obtain multiple smart grid subsystems and a network topology structure subgraph corresponding to each smart grid subsystem; for each smart grid subsystem, determining a detection threshold interval corresponding to each smart grid subsystem according to the function and coverage of the smart grid subsystem, and storing the detection threshold interval corresponding to each smart grid subsystem in the master station node, the detection threshold interval including an upper detection threshold value and a lower detection threshold value.

[0048] In some embodiments, the execution subject has locally stored a network topology structure diagram group, and the network topology structure diagram group includes network topology structure diagrams corresponding to the smart grid systems in various regions. On this basis, the network topology structure diagram corresponding to the smart grid system in the target area is obtained, wherein the smart grid system is a power grid system that can protect users, resist attacks, and provide power quality that meets user needs. The network topology structure diagram is a structure diagram composed of network node devices and communication media, and the network topology structure diagram includes multiple nodes. In practice, the total number of nodes and the maximum depth of the network topology structure diagram are counted, and the total number of nodes and the maximum depth are compared with the preset node threshold. If the total number of nodes is greater than the preset node threshold and the maximum depth is greater than the preset node threshold, then according to the network topology structure diagram, according to the standard that the total number of nodes is less than or equal to the preset node threshold and the maximum depth is less than or equal to the preset node threshold, the smart grid system and the network topology structure diagram are divided, and multiple smart grid subsystems and the network topology structure subgraph corresponding to each smart grid subsystem are obtained. Each smart grid subsystem corresponds to a network topology structure subgraph.

[0049] In practice, the functions and coverage of each smart grid subsystem are graded, and each smart grid subsystem's function level corresponds to a detection threshold interval, and each smart grid subsystem's coverage level corresponds to a detection threshold interval. If the detection threshold interval corresponding to the function level of each smart grid subsystem is the same as the detection threshold interval corresponding to the coverage level of the smart grid subsystem, the detection threshold interval corresponding to the function level of the smart grid subsystem is determined as the detection threshold interval corresponding to the smart grid subsystem. If the detection threshold interval corresponding to the function level of each smart grid subsystem is different from the detection threshold interval corresponding to the coverage level of the smart grid subsystem, the detection threshold upper limit value and the detection threshold lower limit value of the two detection threshold intervals are compared, and the minimum detection threshold lower limit value and the maximum detection threshold upper limit value are taken to generate a new detection threshold interval, and the new detection threshold interval is used as the detection threshold interval corresponding to the smart grid subsystem. Among them, the functions of the smart grid subsystem can be energy management function, intelligent power transmission and transformation function, distributed power supply function, energy storage function, and the coverage can be a certain town. In practice, the detection threshold interval corresponding to each smart grid subsystem is stored in the master station node, and the detection threshold interval includes an upper detection threshold value and a lower detection threshold value.

[0050] Step 103, for each smart grid subsystem, multiple measurement values ​​of the smart grid subsystem are obtained, and the multiple measurement values ​​are sent to the master station node, so that the master station node constructs a first measurement feature according to the multiple measurement values, and inputs the first measurement feature into the small model to obtain a first attack probability corresponding to the smart grid subsystem, and compare the first attack probability with the detection threshold corresponding to the smart grid subsystem. If the first attack probability is less than or equal to the lower limit value of the detection threshold, a prompt message indicating that there is no attack risk is generated; if the first attack probability is greater than the upper limit value of the detection threshold corresponding to the smart grid subsystem, a protection instruction for the protection device is generated.

[0051] Optionally, obtaining multiple measurement values ​​of the smart grid subsystem further includes the following steps:

[0052] Step 1: According to the network topology diagram corresponding to the smart grid system, multiple nodes are grouped to obtain a device node group, a communication node group and a master station node group.

[0053] In some embodiments, according to the network topology diagram corresponding to the smart grid system, multiple nodes are grouped according to the function of each node in the network topology diagram to obtain a device node group, a communication node group and a master station node group.

[0054] Step two, for the communication node group, divide the communication node group into a communication leaf node group, a communication intermediate node group and a communication root node group according to the type of node to which each communication node is connected, wherein the communication leaf nodes in the communication leaf node group are directly connected to the power distribution equipment nodes, and the communication root nodes in the communication root node group are directly connected to the main station nodes.

[0055] In some embodiments, for the communication node group, the communication node group is divided into a communication leaf node group, a communication intermediate node group and a communication root node group according to the type of node to which each communication node is connected, wherein the communication leaf nodes in the communication leaf node group are directly connected to the power distribution equipment nodes, the communication intermediate nodes in the communication intermediate node group are nodes connecting the communication leaf nodes and the communication root nodes, and the communication root nodes in the communication root node group are directly connected to the master station nodes.

[0056] Step three, according to the pre-set node extraction ratio, nodes are extracted from the device node group, communication leaf node group, communication intermediate node group, and communication root node group respectively to obtain multiple extracted node groups, and the multiple extracted node groups include extracted device node group, extracted communication leaf node group, extracted communication intermediate node group, and extracted communication root node group.

[0057] In some embodiments, as an example, a preset node extraction ratio is set to 10%, and 10% of the nodes of each node group are randomly extracted from the device node group, the communication leaf node group, the communication intermediate node group, and the communication root node group, respectively, to obtain multiple extracted node groups, and the multiple extracted node groups include an extracted device node group, an extracted communication leaf node group, an extracted communication intermediate node group, and an extracted communication root node group.

[0058] Step 4: Obtain a measurement indicator configuration table, and extract measurement indicators corresponding to each extracted node group from the measurement indicator configuration table.

[0059] In some embodiments, the execution subject has stored a measurement indicator configuration table locally, and the information in the measurement indicator configuration table includes the node group name and the measurement indicator corresponding to the node group, and the measurement indicator corresponding to each node group is different. On this basis, the execution subject obtains the measurement indicator configuration table locally and queries the measurement indicator corresponding to each extracted node group in the measurement indicator configuration table. Among them, the measurement indicator corresponding to the extracted device node group can be the number of device alarms, the measurement indicator corresponding to the extracted communication leaf node group can be the number of attempts to modify login information, the measurement indicator corresponding to the extracted communication intermediate node group can be the number of data transmission anomalies, and the measurement indicator corresponding to the extracted communication root node group can be the number of permission escalation applications.

[0060] Step five, according to the measurement index corresponding to each extracted node group, obtain the measurement value corresponding to the measurement index of each node in each extracted node group, and obtain the measurement value group of each extracted node group; according to the measurement value groups corresponding to each extracted node group, generate multiple measurement values ​​of the smart grid subsystem.

[0061] In some embodiments, each node in each extracted node group is measured according to the measurement index corresponding to each extracted node group, and the actual value obtained is the measurement value corresponding to the measurement index of each node, and the measurement values ​​corresponding to the measurement index of each node in each extracted node group constitute the measurement value group of each extracted node group. The measurement values ​​corresponding to the measurement index of each node in the measurement value group corresponding to each extracted node group are averaged to obtain the average measurement value corresponding to each extracted node group, and the average measurement values ​​corresponding to each extracted node group are used as multiple measurement values ​​of the smart grid subsystem.

[0062] In some embodiments, multiple measurement values ​​are sent to a master station node, which uses the multiple measurement values ​​as a first measurement feature and inputs the first measurement feature into a small model. Through calculation of the small model, a first attack probability corresponding to the smart grid subsystem is obtained, and the first attack probability is compared with the detection threshold corresponding to the smart grid subsystem. If the first attack probability is less than or equal to the lower limit of the detection threshold, a prompt message indicating that there is no attack risk is generated; if the first attack probability is greater than the upper limit of the detection threshold corresponding to the smart grid subsystem, a protection instruction is generated for the protection device.

[0063] Step 104, if the first attack probability is less than or equal to the upper limit value of the detection threshold and greater than the lower limit value of the detection threshold, multiple measurement values ​​are sent to the cloud, so that the cloud constructs a second measurement feature based on the multiple measurement values, and inputs the second measurement feature into the large model to obtain a second attack probability, and compares the second attack probability with the intermediate detection threshold to obtain an attack risk detection result, wherein the intermediate detection threshold is generated based on the upper limit value of the detection threshold and the lower limit value of the detection threshold.

[0064] In some embodiments, if the first attack probability is less than or equal to the upper limit value of the detection threshold and greater than the lower limit value of the detection threshold, multiple measurement values ​​are sent to the cloud, and the cloud uses the multiple measurement values ​​as the second measurement feature, and inputs the second measurement feature into the large model. Through the calculation of the large model, the second attack probability is obtained, and the second attack probability is compared with the intermediate detection threshold to obtain the attack risk detection result. Among them, the intermediate detection threshold is obtained by averaging the sum of the upper limit value of the detection threshold and the lower limit value of the detection threshold, and the attack risk detection result is that there is an attack risk or there is no attack risk. If the second attack probability is less than or equal to the intermediate detection threshold, the attack risk detection result obtained is that there is no attack risk, and if the second attack probability is greater than the intermediate detection threshold, the attack risk detection result obtained is that there is an attack risk.

[0065] In these embodiments, the defense effect against network attacks is improved. Specifically, a corresponding detection threshold interval is set for each smart grid subsystem to achieve targeted network attack defense. In practice, different smart grid subsystems have different measurement values ​​when attacked. If the same detection threshold is set, the generated detection results will be inaccurate. Therefore, the detection threshold interval is set in a targeted manner, thereby improving the accuracy of the detection results and improving the defense effect against network attacks. In addition, the attack risks are screened by small models, and the attack risks that are difficult to judge by small models are calculated using large models, thereby improving the accuracy of the detection results.

[0066] In some embodiments, in order to further solve the second technical problem described in the background technology section, that is, "the existing small models are obtained by splitting the large models, which will split a large number of small models and lack a small model screening mechanism", in some embodiments of the present invention, the generation of the small model includes the following steps:

[0067] Step 1: Obtain a pre-configured small model parameter range, slice the large model according to the small model parameter range, and obtain multiple slice models, wherein the parameter of each slice model conforms to the small model parameter range.

[0068] In some embodiments, as an example, a pre-configured small model parameter range is obtained, and the small model parameter range may be 3 million to 5 million. According to the small model parameter range, the large model is sliced ​​to obtain multiple slice models, and the parameter amount of each slice model is between 3 million and 5 million.

[0069] Step 2: For each test sample in the test sample set, input the test sample into the large model and each slice model in the multiple slice models, and determine the attack probability output by the large model as the benchmark attack probability, and determine the attack probability output by each slice model as the actual attack probability. Calculate the difference between each actual attack probability and the benchmark attack probability to obtain the probability difference of each slice model; sort the multiple slice models in order of probability difference from small to large to obtain the slice model sequence corresponding to each test sample.

[0070] In some embodiments, the execution subject has locally stored a test sample set, and the test sample set includes multiple test samples. On this basis, for each test sample in the test sample set, the test sample is input into the large model and each slice model in the multiple slice models, and the attack probability output by the large model is used as the benchmark attack probability through the calculation of the large model and each slice model, and the attack probability output by each slice model is used as the actual attack probability, and the difference between each actual attack probability and the benchmark attack probability is calculated respectively to obtain the probability difference of each slice model. In order of the probability difference from small to large, the multiple slice models are sorted to obtain the slice model sequence corresponding to each test sample. As an example, the multiple slice models may include slice model 1, slice model 2, and slice model 3. The attack probability output by the large model can be 80%, that is, the benchmark attack probability is 80%, and the attack probability output by slice model 1 can be 75%, that is, the actual attack probability of slice model 1 is 75%, and the probability difference is 5%. The attack probability output by slice model 2 may be 70%, that is, the actual attack probability of slice model 2 is 70%, and the probability difference is 10%. The attack probability output by slice model 3 may be 73%, that is, the actual attack probability of slice model 3 is 73%, and the probability difference is 7%. The multiple slice models are sorted in order of probability difference from small to large, and the slice model sequence corresponding to each test sample is obtained as slice model 1, slice model 3, and slice model 2.

[0071] Step three, in order of probability difference from small to large, select a target number of slice models from the slice model sequence corresponding to each test sample as candidate slice models, and the candidate slice models corresponding to each test sample in the test sample set constitute a candidate slice model set; for candidate slice models in the candidate slice model set that appear more than or equal to twice, determine them as seed slice models, and count the number of occurrences corresponding to each seed slice model; sort multiple seed slice models in order of the number of occurrences from large to small to obtain a seed slice model sequence.

[0072] In some embodiments, as an example, the target number is set to 2, and the test sample set may include test sample 1, test sample 2, and test sample 3. The slice model sequence corresponding to test sample 1 may be slice model 1, slice model 3, and slice model 2; the slice model sequence corresponding to test sample 2 may be slice model 1, slice model 2, and slice model 3; and the slice model sequence corresponding to test sample 3 may be slice model 2, slice model 1, and slice model 3. On this basis, according to the order of probability difference from small to large, 2 slice models are selected from the slice model sequence corresponding to each test sample as candidate slice models, and each test sample corresponds to 2 candidate slice models. The candidate slice models corresponding to test sample 1 are slice model 1 and slice model 3, the candidate slice models corresponding to test sample 2 are slice model 1 and slice model 2, and the candidate slice models corresponding to test sample 3 are slice model 2 and slice model 1. The candidate slice models corresponding to each test sample in the test sample set are respectively formed into a candidate slice model set, and the candidate slice model set includes slice model 1, slice model 3, slice model 1, slice model 2, slice model 2, and slice model 1. The candidate slice models that appear twice or more in the candidate slice model set are determined as seed slice models. The number of occurrences of slice model 1 in the candidate slice model set is 3 times, the number of occurrences of slice model 2 is 2 times, and the number of occurrences of slice model 3 is 1 time. The obtained seed slice models are slice model 1 and slice model 2. The multiple seed slice models are sorted in descending order of the number of occurrences to obtain a seed slice model sequence, which is slice model 1 and slice model 2.

[0073] Step 4, determine whether the resource requirements of the seed slicing model ranked first in the seed slicing model sequence match the resource configuration of the master station node. If not, continue to determine whether the resource requirements of the next seed slicing model in the seed slicing model sequence match the resource configuration of the master station node, until a seed slicing model that matches the resource configuration of the master station node appears, and the matching seed slicing model is determined as a candidate small model.

[0074] In some embodiments, as an example, the seed slicing model ranked first in the seed slicing model sequence is slicing model 1, and it is determined whether the resource requirements of slicing model 1 match the resource configuration of the master station node. If they match, slicing model 1 is determined as a candidate small model. If not, it is continued to be determined whether the resource requirements of the next seed slicing model in the seed slicing model sequence match the resource configuration of the master station node, until a seed slicing model that matches the resource configuration of the master station node appears, and the matching seed slicing model is determined as a candidate small model.

[0075] Step 5: Use the training sample set of the smart grid system to train the candidate small models to obtain the small model of the master station node.

[0076] In some embodiments, the smart grid system is pre-configured with a training sample set. On this basis, the candidate small model is trained using the training sample set of the smart grid system to obtain a small model of the master station node.

[0077] Among them, a network attack intelligent defense method based on large and small model collaboration of the present invention also includes the following steps:

[0078] Step 1: If the attack risk detection result indicates that there is an attack risk, access control information for the protection device is generated, so that the protection device performs access control on the smart grid subsystem according to the access control information.

[0079] The access control information is generated through the following sub-steps:

[0080] Sub-step one, determining the smart grid subsystem with attack risk as the target smart grid subsystem, obtaining multiple importance influencing factors of the target smart grid subsystem, the multiple importance influencing factors including the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area; generating an importance coefficient based on the multiple importance influencing factors and the weight corresponding to each importance influencing factor.

[0081] In some embodiments, a smart grid subsystem with an attack risk is determined as a target smart grid subsystem, and the target smart grid subsystem can be any smart grid subsystem. On this basis, multiple importance influencing factors of the target smart grid subsystem are obtained, and the multiple importance influencing factors include the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area. As an example, the area of ​​the coverage area can be 5 square kilometers, 10 square kilometers, and 15 square kilometers, and the area type of the coverage area can be rural, township, and town. Scores are given to multiple importance influencing factors respectively. The larger the area of ​​the coverage area, the higher the corresponding score. The area of ​​the coverage area is 5 square kilometers, and the corresponding score is 50. The area of ​​the coverage area is 10 square kilometers, and the corresponding score is 70. The area of ​​the coverage area is 15 square kilometers, and the corresponding score is 90. Among the area types of the coverage area, the score corresponding to the rural area type is less than the score corresponding to the township area type, which is less than the score corresponding to the town area type. The score corresponding to the rural area type is 60, the score corresponding to the township area type is 70, and the score corresponding to the town area type is 80. The score corresponding to the users in the configuration list in the coverage area is higher than the score corresponding to the users not in the configuration list in the coverage area. The score corresponding to the users in the configuration list in the coverage area is 90, and the score corresponding to the users not in the configuration list in the coverage area is 60. The weight corresponding to each importance influencing factor can be 0.4 for the area of ​​the coverage area, 0.5 for the area type of the coverage area, and 0.1 for whether there are users in the configuration list in the coverage area. The score corresponding to each importance influencing factor is multiplied by the weight corresponding to each importance influencing factor, and then added, and then converted into percentage to obtain the importance coefficient. As an example, the area of ​​the coverage area of ​​the target smart grid subsystem can be 5 square kilometers, the area type of the coverage area can be rural, and there are no users in the configuration list in the coverage area. The final importance coefficient is 0.56.

[0082] Sub-step 2: querying corresponding access control information from a pre-configured access control list according to the importance coefficient.

[0083] In some embodiments, the access control list is a list of authorized users or subjects and the access rights they have. In practice, different ranges of importance coefficients correspond to different access rights levels. The larger the importance coefficient, the higher the corresponding access right level. On this basis, the access right level corresponding to the importance coefficient is determined, and the corresponding access control information is queried from the pre-configured access control list. The access control information includes the name of the authorized user or subject, the access right level, and the login information.

[0084] In some embodiments, if the attack risk detection result is that there is an attack risk, access control information for the protection device is generated, and the protection device verifies the access rights of the access control information. After the verification is passed, access control is performed on the smart grid subsystem.

[0085] In these embodiments, the accuracy of the small model is improved. Specifically, the probability difference between each small model and the large model is calculated to improve the accuracy of the small model. In practice, the smaller the probability difference, the higher the accuracy of the small model. Therefore, the accuracy of the small model is improved by the probability difference.

[0086] In some embodiments, in order to further solve the technical problem 3 described in the background technology section, that is, "the existing defense methods generally carry out targeted defense when the intrusion risk is detected, and lack an advance prevention mechanism", in some embodiments of the present invention, the cloud is connected to the master station nodes in multiple regions. On this basis, in the network attack intelligent defense method based on the collaboration of large and small models of the present invention, the cloud is also used to perform the following processing steps:

[0087] Step 1: construct subsystem features corresponding to each smart grid subsystem for each region, and the subsystem features corresponding to the multiple regions constitute a subsystem feature library.

[0088] In some embodiments, for each region's multiple smart grid subsystems, a subsystem feature corresponding to each smart grid subsystem is constructed, and the subsystem features corresponding to the multiple regions constitute a subsystem feature library, wherein the subsystem features include the function and coverage of the smart grid subsystem.

[0089] Step 2: When the attack risk detection result indicates that there is an attack risk, the smart grid subsystem with the attack risk is determined as the target smart grid subsystem, and the subsystem feature corresponding to the target smart grid subsystem is queried in the subsystem feature library and determined as the target subsystem feature, and at least one subsystem feature whose Euclidean distance with the target subsystem feature is less than a preset distance threshold is queried in the subsystem feature library, and at least one subsystem feature is determined as a similar subsystem feature to obtain a similar subsystem feature group; the smart grid subsystem corresponding to the similar subsystem feature is determined as the similar smart grid subsystem corresponding to the target smart grid subsystem to obtain a similar smart grid subsystem group.

[0090] In some embodiments, the execution subject locally stores a subsystem feature library. On this basis, the smart grid subsystem with attack risk is determined as the target smart grid subsystem, and the subsystem feature corresponding to the target smart grid subsystem is queried in the subsystem feature library and determined as the target subsystem feature. The target subsystem feature can be any subsystem feature. In practice, the Euclidean distance is the real distance between two subsystem features in the m-dimensional space. Each subsystem feature corresponds to a position coordinate in the m-dimensional space. The Euclidean distance between the two subsystem features is calculated by the distance formula of the Euclidean distance. On this basis, the Euclidean distance between each subsystem feature in the subsystem feature library and the target subsystem feature is calculated, and at least one subsystem feature whose Euclidean distance with the target subsystem feature is less than a preset distance threshold is selected, and at least one subsystem feature is determined as a similar subsystem feature, and multiple similar subsystem features form a similar subsystem feature group. In practice, the smart grid subsystem corresponding to the similar subsystem feature is determined as the similar smart grid subsystem corresponding to the target smart grid subsystem, and multiple similar smart grid subsystems form a similar smart grid subsystem group.

[0091] Step three, obtaining multiple importance influencing factors of each similar smart grid subsystem in the similar smart grid subsystem group, the multiple importance influencing factors include the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area; for each similar smart grid subsystem, adding each importance influencing factor as a dimension feature to the corresponding similar subsystem feature, and obtaining the updated similar subsystem feature of each similar smart grid subsystem, thereby achieving local enhancement of the similar subsystem feature; similarly, generating the target updated similar subsystem feature of the target smart grid subsystem.

[0092] In some embodiments, multiple importance influencing factors of each similar smart grid subsystem are obtained from the similar smart grid subsystem group, and the multiple importance influencing factors include the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area. In practice, each importance influencing factor corresponding to each similar smart grid subsystem is added as a dimensional feature to the corresponding similar subsystem feature to obtain the updated similar subsystem feature of each similar smart grid subsystem, so as to achieve local enhancement of the similar subsystem feature; similarly, each importance influencing factor corresponding to the target smart grid subsystem is added as a dimensional feature to the corresponding target similar subsystem feature to obtain the target updated similar subsystem feature of the target smart grid subsystem.

[0093] Step 4: Determine the Euclidean distance between the target updated similar subsystem feature and each updated similar subsystem feature to obtain the update distance, and select at least one similar smart grid subsystem whose update distance is less than a preset distance threshold from the similar smart grid subsystem group according to the update distance to form a smart grid subsystem group to be adjusted.

[0094] In some embodiments, the Euclidean distance between the target updated similar subsystem feature and each updated similar subsystem feature is calculated, that is, the update distance, and at least one similar smart grid subsystem whose update distance is less than a preset distance threshold is selected from the similar smart grid subsystem group to form the smart grid subsystem group to be adjusted.

[0095] Step five, for each smart grid subsystem to be adjusted in the group of smart grid subsystems to be adjusted, generate a threshold adjustment coefficient for each smart grid subsystem to be adjusted according to the importance coefficient of the smart grid subsystem to be adjusted; and adjust the detection threshold interval of each smart grid subsystem to be adjusted according to the threshold adjustment coefficient to obtain an updated detection threshold interval; and send the updated detection threshold interval to the master station node of the corresponding area.

[0096] In some embodiments, for each smart grid subsystem to be adjusted in the group of smart grid subsystems to be adjusted, the importance coefficient of the smart grid subsystem to be adjusted is used as the threshold adjustment coefficient of each smart grid subsystem to be adjusted, and the threshold adjustment coefficient is multiplied by the detection threshold upper limit value and the detection threshold lower limit value in the detection threshold interval of each smart grid subsystem to be adjusted, respectively, to obtain an updated detection threshold upper limit value and an updated detection threshold lower limit value, and the detection threshold interval between the updated detection threshold upper limit value and the updated detection threshold lower limit value is used as the updated detection threshold interval, and the updated detection threshold interval is sent to the master station node of the corresponding area.

[0097] In these embodiments, the defense capability of the smart grid subsystem is improved. Specifically, the detection threshold interval of similar smart grid subsystems is updated to achieve early prevention of the same type of network attacks. In practice, similar smart grid subsystems have similar structures and are subjected to the same type of network attacks. After a smart grid subsystem is attacked, the detection threshold interval of the similar smart grid subsystem is updated, thereby improving the defense capability of the similar smart grid subsystem and achieving early prevention of the same type of network attacks.

[0098] The above descriptions are only some preferred embodiments of the present invention and the explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present invention is not limited to the technical solutions formed by the specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A network attack intelligent defense method based on large and small model collaboration, characterized in that: include: Deploy a large model in the cloud and deploy small models in the master nodes in the target area. Each master node is connected to the cloud. Obtain a network topology structure diagram corresponding to the smart grid system in the target area, the network topology structure diagram including multiple nodes; determine the total number of nodes and the maximum depth corresponding to the network topology structure diagram; if the total number of nodes is greater than a preset node threshold and the maximum depth is greater than the preset node threshold, divide the smart grid system according to the network topology structure diagram to obtain multiple smart grid subsystems and a network topology structure subgraph corresponding to each smart grid subsystem; for each smart grid subsystem, determine a detection threshold interval corresponding to each smart grid subsystem according to the function and coverage of the smart grid subsystem, and store the detection threshold interval corresponding to each smart grid subsystem in the master station node, the detection threshold interval including an upper detection threshold value and a lower detection threshold value; For each smart grid subsystem, multiple measurement values ​​of the smart grid subsystem are obtained, and the multiple measurement values ​​are sent to the master station node, so that the master station node constructs a first measurement feature according to the multiple measurement values, and the first measurement feature is input into the small model to obtain a first attack probability corresponding to the smart grid subsystem, and the first attack probability is compared with the detection threshold corresponding to the smart grid subsystem. If the first attack probability is less than or equal to the lower limit value of the detection threshold, a prompt message indicating that there is no attack risk is generated; if the first attack probability is greater than the upper limit value of the detection threshold corresponding to the smart grid subsystem, a protection instruction for the protection device is generated; If the first attack probability is less than or equal to the detection threshold upper limit value and greater than the detection threshold lower limit value, multiple measurement values ​​are sent to the cloud, so that the cloud constructs a second measurement feature according to the multiple measurement values, and inputs the second measurement feature into the large model to obtain a second attack probability, and compares the second attack probability with an intermediate detection threshold to obtain an attack risk detection result, wherein the intermediate detection threshold is generated according to the detection threshold upper limit value and the detection threshold lower limit value; The intermediate detection threshold is obtained by averaging the sum of the upper limit value of the detection threshold and the lower limit value of the detection threshold, and the attack risk detection result is that there is an attack risk or there is no attack risk; if the second attack probability is less than or equal to the intermediate detection threshold, the attack risk detection result is that there is no attack risk, and if the second attack probability is greater than the intermediate detection threshold, the attack risk detection result is that there is an attack risk; Obtaining a pre-configured small model parameter range, slicing the large model according to the small model parameter range to obtain a plurality of slice models, wherein the parameter amount of each slice model conforms to the small model parameter range; For each test sample in the test sample set, input the test sample into the large model and each slice model in the multiple slice models, and determine the attack probability output by the large model as the benchmark attack probability, and determine the attack probability output by each slice model as the actual attack probability, and respectively calculate the difference between each actual attack probability and the benchmark attack probability to obtain the probability difference of each slice model; sort the multiple slice models in order of the probability difference from small to large to obtain a slice model sequence corresponding to each test sample; According to the order of probability difference from small to large, a target number of slice models are selected from the slice model sequence corresponding to each test sample as candidate slice models, and the candidate slice models corresponding to each test sample in the test sample set respectively constitute a candidate slice model set; for the candidate slice models in the candidate slice model set that appear more than or equal to twice, they are determined as seed slice models, and the number of occurrences corresponding to each seed slice model is counted; multiple seed slice models are sorted according to the order of the number of occurrences from large to small to obtain a seed slice model sequence; Determine whether the resource requirement of the seed slicing model ranked first in the seed slicing model sequence matches the resource configuration of the master station node; if not, continue to determine whether the resource requirement of the seed slicing model ranked next in the seed slicing model sequence matches the resource configuration of the master station node, until a seed slicing model matching the resource configuration of the master station node appears, and determine the matching seed slicing model as a candidate small model; The candidate small model is trained using the training sample set of the smart grid system to obtain the small model of the master station node.

2. The network attack intelligent defense method based on large and small model collaboration according to claim 1 is characterized in that: Also includes: If the attack risk detection result indicates that there is an attack risk, access control information for a protection device is generated, so that the protection device performs access control on the smart grid subsystem according to the access control information.

3. The network attack intelligent defense method based on large and small model collaboration according to claim 2 is characterized in that: The access control information is generated according to the following steps: Determine a smart grid subsystem with attack risks as a target smart grid subsystem, and obtain multiple importance influencing factors of the target smart grid subsystem, wherein the multiple importance influencing factors include the area of ​​the coverage area, the area type of the coverage area, and whether there are users in the configuration list in the coverage area; Generate an importance coefficient according to the multiple importance influencing factors and the weight corresponding to each importance influencing factor; According to the importance coefficient, corresponding access control information is queried from a pre-configured access control list.

4. The network attack intelligent defense method based on large and small model collaboration according to claim 3 is characterized in that: The obtaining of a plurality of measurement values ​​of the smart grid subsystem comprises: According to the network topology diagram corresponding to the smart grid system, multiple nodes are grouped to obtain a device node group, a communication node group and a master station node group; For the communication node group, according to the type of node to which each communication node is connected, the communication node group is divided into a communication leaf node group, a communication intermediate node group and a communication root node group, wherein the communication leaf nodes in the communication leaf node group are directly connected to the power distribution equipment nodes, and the communication root nodes in the communication root node group are directly connected to the master station nodes; According to a preset node extraction ratio, nodes are extracted from the device node group, the communication leaf node group, the communication intermediate node group, and the communication root node group to obtain multiple extracted node groups, wherein the multiple extracted node groups include an extracted device node group, an extracted communication leaf node group, an extracted communication intermediate node group, and an extracted communication root node group; Obtaining a measurement indicator configuration table, and extracting measurement indicators corresponding to each extracted node group from the measurement indicator configuration table; According to the measurement index corresponding to each extracted node group, the measurement value corresponding to the measurement index of each node in each extracted node group is obtained to obtain the measurement value group of each extracted node group; according to the measurement value groups corresponding to each extracted node group, multiple measurement values ​​of the smart grid subsystem are generated.

Images