A security defense method and system for power internet of things

Abstract

The application provides a kind of power internet of things security defense method and system, belong to network security technical field.The security defense method includes: obtaining historical traffic;The correlation analysis is carried out to historical traffic, to determine the ip corresponding to historical traffic;With the first access time in a single time period as node, the access sequence information of each ip about positive time flow direction is constructed;According to access sequence information, construct feature matrix;The clustering operation is carried out to feature matrix, to obtain multiple ip classes;Respectively, each ip class is carried out feature extraction operation, to obtain the characteristics of each ip class;The abnormal access times of each ip included in each ip class are counted, and the number of abnormal ips included in each ip class is determined;According to the number of abnormal ips, the ip class is marked as normal ip class or abnormal ip class;The feature matrix is taken as input, and the normal ip class or the abnormal ip class is taken as output to construct a security defense data set;The neural network is trained using the security defense data set to obtain an abnormal traffic identification model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a security defense method and system for the Internet of Things (IoT) of power. Background Technology

[0002] In the field of cybersecurity technology, proactive defense is one of the important methods. Commonly used proactive defense technologies include data encryption, access control, permission settings, vulnerability scanning, honeypot technology, audit tracing technology, and intrusion prevention technology.

[0003] In recent years, with the development of neural networks, intrusion detection technologies based on neural networks, similar to IDS, have emerged. These technologies can accurately detect intrusion traffic by utilizing the inference and prediction capabilities of neural networks. However, this relies on training the neural network with a large amount of data beforehand, and the accuracy of the training depends on the diversity and precision of the dataset. Currently, obtaining such a dataset mainly relies on manually labeling the access traffic, which is inefficient and unable to identify suspicious access traffic. Summary of the Invention

[0004] The purpose of this invention is to provide a security defense method and system for the Internet of Things (IoT) of power, which can improve the efficiency of acquiring neural network datasets and improve the recognition accuracy of neural networks.

[0005] To achieve the above objectives, embodiments of the present invention provide a security defense method for the power Internet of Things, comprising:

[0006] Retrieve historical traffic from the server;

[0007] Perform correlation analysis on the historical traffic to determine the IP address corresponding to the historical traffic;

[0008] Using the first access time within a single time period as a node, construct access sequence information for each IP address in terms of the forward time flow;

[0009] Construct a feature matrix based on the access sequence information;

[0010] Clustering is performed on the feature matrix to obtain multiple IP classes;

[0011] Feature extraction is performed on each of the IP classes to obtain the features of each IP class;

[0012] Count the number of abnormal accesses for each IP address included in each IP class to determine the number of abnormal IP addresses included in each IP class;

[0013] The IP class is classified as normal or abnormal based on the number of abnormal IPs.

[0014] Using the feature matrix as input and normal IP class or abnormal IP class as output, a security defense dataset is constructed.

[0015] The aforementioned security defense dataset was used to train a neural network to obtain an abnormal traffic identification model.

[0016] Optionally, using the first access time within a single time period as a node, access sequence information for each IP address regarding the forward time flow is constructed, including:

[0017] According to the predetermined time period, determine the continuous access information corresponding to each IP;

[0018] Determine whether the number of consecutive accesses to the information is greater than or equal to a preset threshold.

[0019] If the number of accesses to the consecutive access information is greater than or equal to the access threshold, the consecutive access information is marked as the access sequence information.

[0020] Optionally, constructing a feature matrix based on the access sequence information includes:

[0021] Construct the feature matrix according to formula (1).

[0022]

[0023] Among them, Se t Let p be the feature matrix. 11 p 1c p w1 and p wc These are the eigenvectors in the characteristic matrix.

[0024] Optionally, clustering is performed on the feature matrix to obtain multiple IP classes, including:

[0025] Randomly select multiple IP addresses as the initial center points;

[0026] Calculate the feature distance between the selected IP and other IPs, and assign the other IPs to the set containing the selected IP according to the nearest distance principle to obtain multiple initial classes;

[0027] In each initial class, the sum of distances between each IP and other IPs is calculated, and the IP with the smallest sum is selected as the center point of the current initial class to update the center point;

[0028] Determine whether the center point before and after the update are the same;

[0029] If the center point before the update is different from the center point after the update, return to the step of calculating the feature distance between the selected IP and other IPs respectively, and assigning the other IPs to the set where the selected IP is located according to the nearest distance principle to obtain multiple initial classes;

[0030] If the center point before the update is the same as the center point after the update, the initial class is used as the IP class.

[0031] Optionally, the characteristic distances between the selected IP and other IPs are calculated separately, including:

[0032] Randomly select one row of unselected feature vectors from the selected IPs as the first feature vector;

[0033] Calculate the Euclidean distance between the first feature vector and the feature vectors of each row of the other IP;

[0034] The minimum value of the Euclidean distance is selected as the distance of the first feature vector;

[0035] Determine if there are any unselected feature vectors currently in use;

[0036] If it is determined that there are currently unselected feature vectors, return to the step of randomly selecting a row of unselected feature vectors from the selected IPs as the first feature vector;

[0037] If it is determined that there are no unselected feature vectors, the feature distance is calculated according to formula (2).

[0038]

[0039] Where l is the feature distance, s i is the distance between the eigenvectors of the i-th row and w is the row number.

[0040] Optionally, the Euclidean distance between the first feature vector and the feature vectors of each row of the other IP is calculated, including:

[0041] The Euclidean distance is calculated according to formula (3).

[0042]

[0043] Where, p ij p′ ij These are the eigenvectors in the i-th row and j-th column of the two eigenvectors, respectively.

[0044] Optionally, a neural network is trained using the security defense dataset to obtain an abnormal traffic identification model, including:

[0045] An RNN network is used as the neural network.

[0046] On the other hand, the present invention also provides a security defense system for the Internet of Things for power, the security defense system including a processor configured to execute the security defense method as described above.

[0047] Through the above technical solutions, the embodiments of the present invention provide a security defense method and system for the Internet of Things in the power industry. This security defense method and system, by labeling normal IP classes and abnormal IP classes and combining clustering judgment, enables suspicious access traffic with high similarity to be identified during the labeling process, thereby improving the efficiency of obtaining neural network datasets and improving the recognition accuracy of neural networks.

[0048] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0049] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0050] Figure 1 This is a flowchart of a security defense method for a power Internet of Things according to an embodiment of the present invention;

[0051] Figure 2 This is a partial flowchart of a security defense method for a power Internet of Things according to an embodiment of the present invention; and

[0052] Figure 3 This is a partial flowchart of a security defense method for the Internet of Things in the power industry according to one embodiment of the present invention. Detailed Implementation

[0053] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0054] like Figure 1 The diagram shown is a flowchart of a security defense method for a power Internet of Things according to an embodiment of the present invention. Figure 1 In this context, the security defense method may include the following steps:

[0055] In step S10, the server's historical traffic is obtained;

[0056] In step S11, a correlation analysis is performed on the historical traffic to determine the IP address corresponding to the historical traffic.

[0057] In step S12, the access sequence information of each IP in the forward time flow is constructed using the first access time within a single time period as the node;

[0058] In step S13, a feature matrix is ​​constructed based on the access sequence information;

[0059] In step S14, clustering is performed on the feature matrix to obtain multiple IP classes;

[0060] In step S15, feature extraction is performed on each IP class to obtain the features of each IP class;

[0061] In step S16, the number of abnormal accesses for each IP included in each IP class is counted to determine the number of abnormal IPs included in each IP class;

[0062] In step S17, the IP class is classified as normal IP class or abnormal IP class based on the number of abnormal IPs;

[0063] In step S18, the feature matrix is ​​used as input and normal IP class or abnormal IP class is used as output to construct a security defense dataset;

[0064] In step S19, a neural network is trained using a security defense dataset to obtain an abnormal traffic identification model.

[0065] In such Figure 1 In the method shown, step S10 can be used to obtain the server's historical traffic. This historical traffic can be the website access traffic retrieved from the server.

[0066] Step S11 can be used to perform correlation analysis on historical traffic to determine the IP address corresponding to the historical traffic. This correlation analysis operation can be a classification operation of access traffic for a single IP address.

[0067] Step S12 can be used to construct access sequence information for each IP address with respect to the forward time flow, using the first access time within a single time period as the node. The specific method for obtaining this access sequence information can be of various forms known to those skilled in the art. In one example of the present invention, the access sequence information can be obtained by first determining the continuous access information corresponding to each IP address according to a predetermined time period. This predetermined time period can be, for example, 24 hours or 48 hours. The continuous access information can be the access information of an IP address within a short period. Then, it is determined whether the number of accesses in the continuous access information is greater than or equal to a preset threshold. If the number of accesses in the continuous access information is greater than or equal to the threshold, the continuous access information is marked as access sequence information.

[0068] Step S13 can be used to construct a feature matrix based on the access sequence information. Specifically, this feature matrix can be constructed using the following formula (1).

[0069] Construct the feature matrix according to formula (1).

[0070]

[0071] Among them, Se t p is the characteristic matrix 11 p 1c p w1 and p wc These are the eigenvectors in the characteristic matrix.

[0072] Step S14 can be used to perform a clustering operation on the feature matrix to obtain multiple IP classes. This clustering operation can be performed in various ways known to those skilled in the art. In one example of the present invention, the clustering operation can include, for example... Figure 2 The method shown in the diagram. Figure 2 In this context, the clustering operation may include the following steps:

[0073] In step S20, multiple IPs are randomly selected as initial center points;

[0074] In step S21, the feature distances between the selected IP and other IPs are calculated respectively. The other IPs are then assigned to the set containing the selected IP according to the nearest distance principle to obtain multiple initial classes. The specific method for calculating the feature distance can be of various forms known to those skilled in the art. In one example of the present invention, the method for calculating the feature distance may include the following steps:

[0075] In step S30, a row of unselected feature vectors is randomly selected from the selected IPs as the first feature vector;

[0076] In step S31, the Euclidean distance between the first feature vector and the feature vectors of each row of the other IP is calculated. This Euclidean distance can be calculated using the following formula (3).

[0077]

[0078] Where, p ij p′ ij These are the eigenvectors in the i-th row and j-th column of the two eigenvectors, respectively.

[0079] In step S32, the minimum value of the Euclidean distance is selected as the distance of the first feature vector;

[0080] In step S33, it is determined whether there are currently any unselected feature vectors;

[0081] If it is determined that there are currently unselected feature vectors, return to the step of randomly selecting a row of unselected feature vectors from the selected IPs as the first feature vector, that is, return to the step of step S30.

[0082] In step S34, if it is determined that there are no unselected feature vectors, the feature distance is calculated according to formula (2).

[0083]

[0084] Where l is the feature distance, s i is the distance between the eigenvectors of the i-th row and w is the row number.

[0085] In step S22, within each initial class, the sum of distances between each IP and other IPs is calculated, and the IP with the smallest sum is selected as the center point of the current initial class to update the center point;

[0086] In step S23, it is determined whether the center point before the update and the center point after the update are the same;

[0087] If the center point before the update and the center point after the update are different, return to the step of calculating the feature distance between the selected IP and other IPs respectively, and assigning the other IPs to the set where the selected IP is located according to the nearest distance principle to obtain multiple initial classes, that is, return to the step of executing step S21;

[0088] In step S24, if the center point before the update and the center point after the update are the same, the initial class is used as the IP class.

[0089] Step S15 can be used to perform feature extraction operations on each IP class separately to obtain the features of each IP class. Regarding the specific method for obtaining this feature extraction operation, in one example of the present invention, it can be to determine the feature matrix corresponding to the center point of the IP class as the extracted feature. In another example of the present invention, it can also be to take the mean of all feature matrices of the class as the extracted feature.

[0090] Step S16 can be used to count the number of abnormal accesses for each IP address included in each IP class, and to determine the number of abnormal IP addresses included in each IP class. Considering that even normally accessing IP addresses may generate abnormal access or click events, this implementation uses step S16 to filter IP classes.

[0091] Step S17 can be used to classify IPs as normal or abnormal based on the number of abnormal IPs.

[0092] Step S18 can be used to construct a security defense dataset by taking the feature matrix as input and normal IP class or abnormal IP class as output.

[0093] Step S19 can be used to train a neural network using a security defense dataset to obtain an abnormal traffic identification model. In one example of the present invention, step S19 can be performed using an RNN network as the neural network.

[0094] On the other hand, the present invention also provides a security defense system for the power Internet of Things, the security defense system including a processor configured to execute the security defense method as described above. Specifically, the security defense method may include the following steps:

[0095] In step S10, the server's historical traffic is obtained;

[0096] In step S11, a correlation analysis is performed on the historical traffic to determine the IP address corresponding to the historical traffic.

[0097] In step S12, the access sequence information of each IP in the forward time flow is constructed using the first access time within a single time period as the node;

[0098] In step S13, a feature matrix is ​​constructed based on the access sequence information;

[0099] In step S14, clustering is performed on the feature matrix to obtain multiple IP classes;

[0100] In step S15, feature extraction is performed on each IP class to obtain the features of each IP class;

[0101] In step S16, the number of abnormal accesses for each IP included in each IP class is counted to determine the number of abnormal IPs included in each IP class;

[0102] In step S17, the IP class is classified as normal IP class or abnormal IP class based on the number of abnormal IPs;

[0103] In step S18, the feature matrix is ​​used as input and normal IP class or abnormal IP class is used as output to construct a security defense dataset;

[0104] In step S19, a neural network is trained using a security defense dataset to obtain an abnormal traffic identification model.

[0105] In such Figure 1 In the method shown, step S10 can be used to obtain the server's historical traffic. This historical traffic can be the website access traffic retrieved from the server.

[0106] Step S11 can be used to perform correlation analysis on historical traffic to determine the IP address corresponding to the historical traffic. This correlation analysis operation can be a classification operation of access traffic for a single IP address.

[0107] Step S12 can be used to construct access sequence information for each IP address with respect to the forward time flow, using the first access time within a single time period as the node. The specific method for obtaining this access sequence information can be of various forms known to those skilled in the art. In one example of the present invention, the access sequence information can be obtained by first determining the continuous access information corresponding to each IP address according to a predetermined time period. This predetermined time period can be, for example, 24 hours or 48 hours. The continuous access information can be the access information of an IP address within a short period. Then, it is determined whether the number of accesses in the continuous access information is greater than or equal to a preset threshold. If the number of accesses in the continuous access information is greater than or equal to the threshold, the continuous access information is marked as access sequence information.

[0108] Step S13 can be used to construct a feature matrix based on the access sequence information. Specifically, this feature matrix can be constructed using the following formula (1).

[0109] Construct the feature matrix according to formula (1).

[0110]

[0111] Among them, Se t p is the characteristic matrix 11 p 1c p w1 and p wc These are the eigenvectors in the characteristic matrix.

[0112] Step S14 can be used to perform a clustering operation on the feature matrix to obtain multiple IP classes. This clustering operation can be performed in various ways known to those skilled in the art. In one example of the present invention, the clustering operation can include, for example... Figure 2 The method shown in the diagram. Figure 2 In this context, the clustering operation may include the following steps:

[0113] In step S20, multiple IPs are randomly selected as initial center points;

[0114] In step S21, the feature distances between the selected IP and other IPs are calculated respectively. The other IPs are then assigned to the set containing the selected IP according to the nearest distance principle to obtain multiple initial classes. The specific method for calculating the feature distance can be of various forms known to those skilled in the art. In one example of the present invention, the method for calculating the feature distance may include the following steps:

[0115] In step S30, a row of unselected feature vectors is randomly selected from the selected IPs as the first feature vector;

[0116] In step S31, the Euclidean distance between the first feature vector and the feature vectors of each row of the other IP is calculated. This Euclidean distance can be calculated using the following formula (3).

[0117]

[0118] Where, p ij p′ ij These are the eigenvectors in the i-th row and j-th column of the two eigenvectors, respectively.

[0119] In step S32, the minimum value of the Euclidean distance is selected as the distance of the first feature vector;

[0120] In step S33, it is determined whether there are currently any unselected feature vectors;

[0121] If it is determined that there are currently unselected feature vectors, return to the step of randomly selecting a row of unselected feature vectors from the selected IPs as the first feature vector, that is, return to the step of step S30.

[0122] In step S34, if it is determined that there are no unselected feature vectors, the feature distance is calculated according to formula (2).

[0123]

[0124] Where l is the feature distance, s i is the distance between the eigenvectors of the i-th row and w is the row number.

[0125] In step S22, within each initial class, the sum of distances between each IP and other IPs is calculated, and the IP with the smallest sum is selected as the center point of the current initial class to update the center point;

[0126] In step S23, it is determined whether the center point before the update and the center point after the update are the same;

[0127] If the center point before the update and the center point after the update are different, return to the step of calculating the feature distance between the selected IP and other IPs respectively, and assigning the other IPs to the set where the selected IP is located according to the nearest distance principle to obtain multiple initial classes, that is, return to the step of executing step S21;

[0128] In step S24, if the center point before the update and the center point after the update are the same, the initial class is used as the IP class.

[0129] Step S15 can be used to perform feature extraction operations on each IP class separately to obtain the features of each IP class. Regarding the specific method for obtaining this feature extraction operation, in one example of the present invention, it can be to determine the feature matrix corresponding to the center point of the IP class as the extracted feature. In another example of the present invention, it can also be to take the mean of all feature matrices of the class as the extracted feature.

[0130] Step S16 can be used to count the number of abnormal accesses for each IP address included in each IP class, and to determine the number of abnormal IP addresses included in each IP class. Considering that even normally accessing IP addresses may generate abnormal access or click events, this implementation uses step S16 to filter IP classes.

[0131] Step S17 can be used to classify IPs as normal or abnormal based on the number of abnormal IPs.

[0132] Step S18 can be used to construct a security defense dataset by taking the feature matrix as input and normal IP class or abnormal IP class as output.

[0133] Step S19 can be used to train a neural network using a security defense dataset to obtain an abnormal traffic identification model. In one example of the present invention, step S19 can be performed using an RNN network as the neural network.

[0134] Through the above technical solutions, the embodiments of the present invention provide a security defense method and system for the Internet of Things in the power industry. This security defense method and system, by labeling normal IP classes and abnormal IP classes and combining clustering judgment, enables suspicious access traffic with high similarity to be identified during the labeling process, thereby improving the efficiency of obtaining neural network datasets and improving the recognition accuracy of neural networks.

[0135] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0137] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0138] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0139] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0140] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0141] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0142] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0143] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A security defense method of a power Internet of Things, characterized in that, The security defense method comprises: acquiring historical traffic of a server; performing correlation analysis on the historical traffic to determine corresponding ips of the historical traffic; constructing access sequence information of each ip about forward time flow direction with a first access time in a single time period as a node; constructing a feature matrix according to the access sequence information; performing clustering operation on the feature matrix to obtain a plurality of ip classes; respectively performing feature extraction operation on each of the ip classes to obtain features of each ip class; statistically counting abnormal access times of each ip included in each of the ip classes to determine a number of abnormal ips included in each of the ip classes; labeling ip classes as normal ip classes or abnormal ip classes according to the number of abnormal ips; constructing a security defense data set with the feature matrix as input and the normal ip classes or the abnormal ip classes as output; training a neural network using the security defense data set to obtain an abnormal traffic identification model; performing clustering operation on the feature matrix to obtain a plurality of ip classes, comprising: randomly selecting a plurality of ips as initial center points; respectively calculating feature distances between the selected ips and other ips, and distributing other ips to the set of the selected ips according to the nearest distance principle to obtain a plurality of initial classes; in each initial class, respectively calculating the sum of distances between each ip and other ips, and selecting the ip with the smallest sum as the center point of the current initial class to update the center point; judging whether the center point before updating and the center point after updating are the same; in the case where the center point before updating and the center point after updating are not the same, returning to the step of respectively calculating the feature distances between the selected ips and other ips, and distributing other ips to the set of the selected ips according to the nearest distance principle to obtain a plurality of initial classes; in the case where the center point before updating and the center point after updating are the same, taking the initial classes as the ip classes; respectively calculating the feature distances between the selected ips and other ips, comprising: randomly selecting an unselected feature vector from the selected ips as a first feature vector; calculating the Euclidean distance between the first feature vector and each row of feature vectors of other ips; selecting the minimum value of the Euclidean distance as the distance of the first feature vector; judging whether there is an unselected feature vector at present; in the case where there is an unselected feature vector at present, returning to the step of randomly selecting an unselected feature vector from the selected ips as a first feature vector; in the case where there is no unselected feature vector at present, calculating the feature distance according to formula (2), ，（2） wherein, is the feature distance, is the feature distance, is the distance of the feature vector of the row, is the number of rows.

2. The security defense method of claim 1, wherein, constructing access sequence information of each ip about forward time flow direction with a first access time in a single time period as a node, comprising: determining continuous access information corresponding to each ip according to a predetermined time period; judging whether the access times of the continuous access information are greater than or equal to a preset number threshold; in the case where the access times of the continuous access information are greater than or equal to the number threshold, marking the continuous access information as the access sequence information.

3. The method of claim 1, wherein, constructing a feature matrix according to the access sequence information, comprising: constructing the feature matrix according to formula (1), ，（1） wherein, is the feature matrix, , , and is an eigenvector in the feature matrix.

4. The method of claim 1, wherein, calculating the Euclidean distance between the first feature vector and the feature vector of each row of other ips, comprising: calculating the Euclidean distance according to formula (3), ，（3） in, , These are the first two eigenvectors. Line 1 The eigenvectors of the column.

5. The method of claim 1, wherein, training a neural network using the security defense dataset to obtain an abnormal traffic identification model, comprising: using an RNN network as the neural network.

6. A security defense system for power internet of things, characterized in that, The security defense system comprises a processor configured to perform the security defense method according to any one of claims 1 to 5.

Images