Malicious behavior identification method and identification device for power network

Abstract

The invention provides a malicious behavior identification method and identification device for a power network, and the method comprises the steps: obtaining all network flow data which is composed of a plurality of pieces of power variable information and a plurality of category labels, and the power variable information at least comprises power load data, power supply data and current data; the category label is used for representing the category of the corresponding power variable information; carrying out feature reconstruction on the network flow data by adopting an improved self-adaptive elastic network method, and extracting important feature data; inputting the important feature data into a multi-layer integrated detection model, and outputting to obtain a malicious behavior; and carrying out fine-grained classification on the malicious behaviors based on a transformer model to obtain categories of the malicious behaviors. The problem that in the prior art, network malicious behavior detection is limited by data processing and feature extraction, so that malicious behavior detection accuracy is low is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for identifying malicious behavior in an electric power network, a malicious behavior identification device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Malicious behavior detection in power networks mainly includes two parts: one is power network attack detection, and the other is fine-grained identification of detected malicious behaviors. How to find a better feature extraction method is a research hotspot in existing malicious behavior detection algorithms.

[0003] The development of power network attack detection algorithms can be traced back to the early simple detection technology based on rules and statistical methods, and then gradually evolved into network anomaly detection using machine learning algorithms such as support vector machines (SVM) and decision trees. In recent years, with the rapid development of deep learning technology, power network attack detection algorithms based on deep learning have received widespread attention. These algorithms are limited by their limited feature extraction capabilities. They rely on manually selected features and rules, are difficult to process large-scale and high-dimensional data, require a lot of manual intervention and parameter adjustment, are difficult to capture complex attack patterns, and lack adaptability to new attacks. Summary of the invention

[0004] The main purpose of the present application is to provide a method for identifying malicious behavior in an electric power network, a malicious behavior identification device, a computer-readable storage medium and a computer program product, so as to at least solve the problem in the prior art that malicious behavior detection in the network is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for identifying malicious behavior in an electric power network is provided, comprising: obtaining all network traffic data, the network traffic data consisting of multiple power variable information and multiple category labels, the power variable information corresponding to the category labels one by one, the power variable information at least including power load data, power supply data and current data, and the category label being used to indicate the category to which the corresponding power variable information belongs; using an improved adaptive elastic network method to perform feature reconstruction on the network traffic data and extract important feature data, the improved adaptive elastic network method is a method for introducing a feature selection method into an elastic network method to obtain a method for extracting highly important features from a large amount of data, the important feature data at least including the frequency, time period, source and destination of communication; inputting the important feature data into a multi-layer integrated detection model, and outputting malicious behavior, the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; performing fine-grained classification on the malicious behavior based on a transformer model to obtain the category of the malicious behavior.

[0006] Optionally, an improved adaptive elastic network method is used to reconstruct the network traffic data to extract important feature data, including: using a first formula to construct an adaptive elastic network regression model, wherein the first formula is β0 represents the intercept coefficient, β j represents the regression coefficient, i represents the number of the power variable information in the network traffic data, j represents the number of the power data in the power variable information, and x ij represents the jth power data in the i-th power variable information, and p represents the total number of the corresponding power data in the power variable information; the regression loss value is calculated using the adaptive elastic network regression model according to the second formula, and the second formula is: in, N represents the total number of power variable information in the network traffic data, λ * 1 is a fixed non-negative real number, |...| represents the L1 norm element, |...2 represents the L2 norm element, λ2 is an arbitrary non-negative constant, γ is a positive real number, is the regression loss value, express The L1 norm element of , Represents the adjustment coefficient; when the regression loss value is greater than the set loss threshold, the corresponding network traffic data is determined as the important feature data.

[0007] Optionally, before the important feature data is input into the multi-layer integrated detection model and the malicious behavior is output, the method also includes: using a data normalization method to normalize the network traffic sample feature data to obtain normalized feature data; calculating the outlier score of each normalized feature data, the outlier score represents the degree of abnormality of the normalized feature data relative to other normalized feature data; when the outlier score is greater than a set score threshold, determining the corresponding normalized feature data as noise data; training these noise data and normal data based on the PSO-K means clustering algorithm so that the noise data is enhanced during the training process to form the noise adaptive training set, the normal data is the normalized feature data corresponding to the outlier score being less than or equal to the set score threshold.

[0008] Optionally, before inputting the important feature data into the multi-layer integrated detection model and outputting malicious behavior, the method also includes: initializing model parameters, the model parameters at least including the number of input neurons, the number of hidden neurons, the number of output neurons and the deviation of the hidden neurons of the single hidden layer feedforward neural network, the input neurons are neurons of the input layer in the single hidden layer feedforward neural network, the hidden neurons are neurons of the hidden layer in the single hidden layer feedforward neural network, and the output neurons are neurons of the hidden layer in the single hidden layer feedforward neural network; inputting all sample data into multiple single hidden layer feedforward neural networks to obtain classifiers corresponding to each single hidden layer feedforward neural network, the sample data are the network traffic sample data of any group in the sample data set; performing combined optimization on all the classifiers to obtain a classifier sequence, the classifier sequence is a sequence obtained by sorting the performance of all the classifiers from high to low; selecting the output result of the optimal classifier as the output of the multi-layer integrated detection model, the optimal classifier is the first classifier in the classifier sequence, and the output result is malicious behavior or non-malicious behavior.

[0009] Optionally, all the classifiers are combined and optimized to obtain a classifier sequence, including: training all the classifiers using an integrated classifier to obtain training results corresponding to each classifier; verifying all the training results to determine the performance ranking of each classifier, the performance ranking is used to represent the performance ranking of the classifier in different evaluation metrics; calculating the average ranking of each classifier based on the performance ranking of each classifier; and generating the classifier sequence based on the average ranking.

[0010] Optionally, the malicious behavior is fine-grainedly classified based on the transformer model to obtain the category of the malicious behavior, including: using the transformer model to extract features of malicious data to obtain multimodal data; using the encoder in the transformer model to encode the multimodal data to obtain a multimodal feature sequence, and the multimodal feature sequence is the output result of the last layer of encoder in the transformer model; linearly transforming the multimodal feature sequence to obtain a multimodal feature vector, and the multimodal feature vector is used to represent the probability that the malicious behavior belongs to each of the categories; the category corresponding to the maximum value in the multimodal feature vector is determined as the category of the malicious behavior.

[0011] Optionally, the transformer model includes an Embedding layer and an Encoder layer, and the transformer model is used to extract features of malicious data to obtain multimodal data, including: using the Embedding layer to transform the malicious data to obtain corresponding high-dimensional data vectors; inputting all the high-dimensional data vectors into the Encoder layer for encoding to obtain multiple text features; and merging the multiple text features to obtain the multimodal data.

[0012] According to another aspect of the present application, a malicious behavior identification device for an electric power network is provided, the device comprising: an acquisition unit, used to acquire all network traffic data, the network traffic data consisting of a plurality of power variable information and a plurality of category labels, the power variable information corresponding to the category labels one by one, the power variable information at least including power load data, power supply data and current data, the category label being used to indicate the category to which the corresponding power variable information belongs; a reconstruction unit, used to perform feature reconstruction on the network traffic data using an improved adaptive elastic network method to extract important feature data, the improved adaptive elastic network method being in the elastic network method A method for extracting highly important features from a large amount of data by introducing a feature selection method, wherein the important feature data includes at least the frequency, time period, source and destination of the communication; a detection unit is used to input the important feature data into a multi-layer integrated detection model, and output malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; a classification unit is used to perform fine-grained classification of the malicious behavior based on a transformer model to obtain the category of the malicious behavior.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the methods described.

[0014] According to another aspect of the present application, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, any one of the methods described above is implemented.

[0015] Applying the technical solution of the present application, in a method for identifying malicious behavior in a power network, first, all network traffic data are obtained, the network traffic data is composed of multiple power variable information and multiple category labels, the power variable information corresponds to the category labels one by one, the power variable information at least includes power load data, power supply data and current data, and the category labels are used to indicate the category to which the corresponding power variable information belongs; then, an improved adaptive elastic network method is used to reconstruct the features of the network traffic data to extract important feature data, the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, the important feature data at least includes the frequency, time period, source and destination of communication; then, the important feature data is input into a multi-layer integrated detection model, and the malicious behavior is output, the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; finally, the malicious behavior is fine-grainedly classified based on the transformer model to obtain the category of the malicious behavior. The present application first receives the original network traffic data packets, extracts important network traffic features from the original network traffic data packets in the preprocessing stage, and prepares the corresponding normalized feature vectors. The detection and identification are divided into two stages: building a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features of the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the features of the extracted offspring through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, and determining the category of malicious behaviors; the present application solves the problem in the prior art that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1A hardware structure block diagram of a mobile terminal for executing a method for identifying malicious behavior of a power network provided in an embodiment of the present application is shown;

[0017] Figure 2 A schematic diagram of a flow chart of a method for identifying malicious behavior in a power network provided according to an embodiment of the present application is shown;

[0018] Figure 3 A schematic diagram of a specific process of detecting and identifying malicious behavior in a power network provided according to an embodiment of the present application is shown;

[0019] Figure 4 A flow chart of a PSO-K-means clustering algorithm for a power network provided according to an embodiment of the present application is shown;

[0020] Figure 5 A structural diagram of a multi-layer integrated learning model provided according to an embodiment of the present application is shown;

[0021] Figure 6 A structural block diagram of a malicious behavior identification device for a power network provided according to an embodiment of the present application is shown.

[0022] The above drawings include the following reference numerals:

[0023] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] As introduced in the background technology, these algorithms in the prior art are limited by the limited feature extraction capabilities. They rely on manually selected features and rules, and it is difficult to process large-scale and high-dimensional data. They also require a lot of manual intervention and parameter adjustment, and it is difficult to capture complex attack patterns. At the same time, they lack adaptability to new types of attacks. In order to solve the problem that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection, the embodiments of the present application provide a malicious behavior identification method for a power network, a malicious behavior identification device, a computer-readable storage medium, and a computer program product.

[0028] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0029] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for identifying malicious behavior of a power network according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0030] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0031] In this embodiment, a method for identifying malicious behavior of an electric power network running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 2 1 is a flow chart of a method for identifying malicious behavior in a power network according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0033] Step S201, obtain all network traffic data, the above network traffic data consists of multiple power variable information and multiple category labels, the above power variable information corresponds to the above category labels one by one, the above power variable information at least includes power load data, power supply data and current data, the above category label is used to indicate the category to which the corresponding above power variable information belongs.

[0034] Specifically, in the power system network transmission, data presents diversified modes, such as power load data, power supply data, power flow data, voltage data, system log data, etc. These data are collected and processed through communication networks and sensor devices to support the monitoring, control and management of the power system. All network traffic data is obtained and represented in a specific format, such as (x i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) is the power variable information, y i is the category label corresponding to the power variable information.

[0035] Step S202, using an improved adaptive elastic network method to reconstruct features of the above network traffic data and extract important feature data. The above improved adaptive elastic network method is a method that introduces a feature selection method into an elastic network method to extract highly important features from a large amount of data. The above important feature data at least includes the frequency, time period, source and destination of the communication.

[0036] Specifically, the significance of feature reconstruction is to obtain more flexible feature information through raw data, thereby improving the sensitivity of the data and enhancing the analytical capabilities of model training and classification. In addition, in machine learning problems, if the training includes too many features, it will consume a lot of computational overhead and is prone to overfitting, resulting in a decrease in model performance. In order to reduce the impact of high-dimensional learning problems, an improved adaptive elastic network method is used to select features, which can extract relatively important features from a large number of features, such as the frequency of communication, the time period of communication, the source and destination of communication, and other information. Abnormal communication patterns may indicate malicious behavior.

[0037] Step S203, input the above-mentioned important feature data into a multi-layer integrated detection model, and output malicious behavior. The above-mentioned multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above-mentioned noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing.

[0038] Specifically, the above important feature data is input into the multi-layer integrated detection model, and the malicious behavior is output. It should also be noted that the above important feature data needs to be preprocessed before being input into the model. Data normalization is a basic operation of data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution of gradient search. After the model is calculated, the malicious behavior is output.

[0039] Step S204: fine-grained classification of the malicious behavior is performed based on the transformer model to obtain the category of the malicious behavior.

[0040] Specifically, the malicious behaviors are finely classified based on the transformer model to obtain the categories of the malicious behaviors. The transformer module is used to extract features of network traffic, device status, and operation behavior in the data corresponding to the malicious behaviors, and the features of the extracted offspring are mapped through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, improving the security and stability of the power system network, and providing a more comprehensive, efficient and accurate solution for the security detection of the power system network.

[0041] in addition, Figure 3 The process of detecting and identifying malicious behaviors in power networks is demonstrated. First, the data in the network traffic is featured, and then the features are processed through feature reconstruction, feature normalization, particle swarm optimization algorithm and other methods. Finally, a multi-layer integrated ELM learning model is used to detect malicious behaviors and determine whether they are malicious behaviors. If they are malicious behaviors, a transformer-based classification model is used for fine-grained classification.

[0042] In this embodiment, first, all network traffic data are obtained, and the above network traffic data consists of multiple power variable information and multiple category labels. The above power variable information corresponds to the above category labels one by one, and the above power variable information at least includes power load data, power supply data and current data. The above category label is used to indicate the category to which the corresponding power variable information belongs; then, the improved adaptive elastic network method is used to reconstruct the features of the above network traffic data to extract important feature data. The above improved adaptive elastic network method is a method of introducing a feature selection method into the elastic network method to extract highly important features from a large amount of data. The above important feature data at least includes the frequency, time period, source and destination of communication; then, the above important feature data is input into a multi-layer integrated detection model, and malicious behavior is output. The above multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; finally, the above malicious behavior is fine-grainedly classified based on the transformer model to obtain the category of the above malicious behavior. The present application first receives the original network traffic data packets, extracts important network traffic features from the original network traffic data packets in the preprocessing stage, and prepares the corresponding normalized feature vectors. The detection and identification are divided into two stages: building a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features of the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the features of the extracted offspring through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, and determining the category of malicious behaviors; the present application solves the problem in the prior art that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

[0043] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the method for identifying malicious behavior in the power network of the present application will be described in detail below in combination with specific embodiments.

[0044] In order to avoid overfitting of the multi-layer integrated detection model, in an optional implementation manner, the above step S202 includes:

[0045] Step S2021, constructing an adaptive elastic network regression model using the first formula, the first formula is β0 represents the intercept coefficient, β jrepresents the regression coefficient, i represents the number of the above power variable information in the above network traffic data, j represents the number of the power data in the above power variable information, and x ij represents the jth power data in the i-th power variable information, and p represents the total number of the corresponding power data in the power variable information;

[0046] Step S2022, using the above-mentioned adaptive elastic network regression model to calculate the regression loss value according to the second formula, the above-mentioned second formula is in, N represents the total number of the above power variable information in the above network traffic data, λ*1 is a fixed non-negative real number, |...| represents the L1 norm element, |...2 is the L2 norm element, λ2 is an arbitrary non-negative constant, γ is a positive real number, is the above regression loss value, express The L1 norm element of , represents the adjustment coefficient;

[0047] Step S2023, when the above-mentioned regression loss value is greater than the set loss threshold, the corresponding above-mentioned network traffic data is determined as the above-mentioned important feature data.

[0048] In the above embodiment, the significance of feature reconstruction is to obtain more flexible feature information through the original data, thereby improving the sensitivity of the data and enhancing the analytical ability of model training and classification. In addition, in machine learning problems, if the training includes too many features, it will consume a lot of computing overhead and easily overfit, resulting in a decrease in model performance. In order to reduce the impact of high-dimensional learning problems, an improved adaptive elastic network method is used to select features. Let the network traffic data be represented as (x i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) is the power variable information, y i is the category label corresponding to the power variable information. At this time, the adaptive elastic network regression model can be constructed as follows: Regularization terms such as L1 regularization and L2 regularization are introduced to prevent overfitting and improve the generalization ability of the model. The L2 penalty is combined with the weighted L1 penalty to calculate the final regression loss by penalizing the squared error loss. The regression loss value is calculated using the second formula above. L1 penalty and L2 penalty usually refer to a penalty term used in machine learning to help the model avoid overfitting. According to the above calculation, important features with relatively high importance can be extracted from a large number of features, that is, the above-mentioned important feature data, such as the frequency of communication, the time period of communication, the source and destination of communication, and other information. Abnormal communication patterns may indicate malicious behavior. Further, these important feature data are combined into feature vectors and substituted into the training model to obtain more accurate classification results while ensuring low computing and operating costs.

[0049] In order to effectively improve the adaptability of the model to noise data, in an optional implementation manner, before the above step S203, the method further includes:

[0050] Step S301, normalizing the network traffic sample characteristic data using a data normalization method to obtain normalized characteristic data;

[0051] Step S302, calculating an outlier score for each of the normalized feature data, wherein the outlier score indicates the degree of abnormality of the normalized feature data relative to other normalized feature data;

[0052] Step S303, when the outlier score is greater than a set score threshold, the corresponding normalized feature data is determined as noise data;

[0053] Step S304, training the noise data and normal data based on the PSO-K-means clustering algorithm so that the noise data is enhanced during the training process to form the noise adaptive training set, and the normal data is the normalized feature data corresponding to the outlier score being less than or equal to the set score threshold.

[0054] In the above embodiment, the above network traffic sample feature data needs to be preprocessed before being sent to the model training. Data normalization is a basic operation of data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution of gradient search. The data normalization method mainly includes min-max and z-score normalization operations. Taking the z-score normalization operation as an example, the z-score normalization operation is specifically described as: Where X is the above normalized feature data after z-score normalization, x is the network traffic sample feature data, μ is the mean of all network traffic sample feature data, and σ is the standard deviation of all network traffic sample feature data. The noise problem in the data set has always been an important problem affecting the accuracy of classification or regression. Generally, there are two main types of noise in power data, namely, category noise and attribute noise. Category noise is data with incorrect class labels. Attribute noise is data with incorrect attribute values. Considering that in actual situations, the probability value of data points located in sparsely distributed areas of data is lower than that of data in dense areas in the data space. Therefore, these noise data can be regarded as outliers. To this end, a noise data processing method based on the PSO-K means (PSO-Kmeans) clustering algorithm based on the particle swarm optimization (PSO) algorithm is used. The method first calculates the outlier score of each normalized feature data, which indicates the degree of abnormality of each normalized feature data relative to other normalized feature data. By setting a threshold, that is, the above-mentioned set score threshold, the outlier score above the threshold indicates that it may be noise data. According to the set score threshold, the normalized feature data with outlier scores higher than the set score threshold are identified and detected as noise data. Subsequently, these noise data will be enhanced in the training set to form a noise adaptive training set. The noise adaptive training set has more noise data than the original data set. This will enhance the adaptability of the model to noise data and alleviate the overfitting problem of the model to a certain extent. The execution process of the PSOK-means algorithm is as follows Figure 4 shown.

[0055] In order to provide a model basis for constructing a multi-layer integrated detection model, in an optional implementation, before the above step S204, the method further includes:

[0056] Step S401, initializing model parameters, the model parameters at least including the number of input neurons, the number of hidden neurons, the number of output neurons and the deviations of the hidden neurons of the single hidden layer feedforward neural network, the input neurons are neurons of the input layer of the single hidden layer feedforward neural network, the hidden neurons are neurons of the hidden layer of the single hidden layer feedforward neural network, and the output neurons are neurons of the hidden layer of the single hidden layer feedforward neural network;

[0057] Step S402, inputting all sample data into a plurality of the above-mentioned single hidden layer feedforward neural networks to obtain classifiers corresponding to each of the above-mentioned single hidden layer feedforward neural networks, wherein the above-mentioned sample data is the above-mentioned network traffic sample data of any group in the above-mentioned sample data set;

[0058] Step S403, performing combined optimization on all the above classifiers to obtain a classifier sequence, wherein the above classifier sequence is a sequence obtained by sorting the performance of all the above classifiers from high to low;

[0059] Step S404, selecting the output result of the optimal classifier as the output of the multi-layer integrated detection model, the optimal classifier is the first classifier in the classifier sequence, and the output result is malicious behavior or non-malicious behavior.

[0060] In the above embodiment, the ELM model is a single-hidden layer feedforward neural network (SLFN) model, which can randomly select input weights and implicit biases without any adjustment. Initialize the parameters in the single hidden layer feedforward neural network, let A be the number of input neurons, that is, the number of important input features, let B be the number of hidden neurons; C is the number of output neurons, that is, the number of output categories, and at the same time, let the input weight matrix be K = [k1, k2, ..., k j ,...,k B ], where k j =[k j1 ,k j2 ,...,k jn ] is the vector connecting A input neurons and the jth hidden neuron, b=[b1,b2,...,b j ,....,b B ] is the bias vector of the hidden neuron, b j is the bias of the jth hidden neuron. Any input data in the model is x i The output of ' is: h(x i ')=G(Kx i '+b), G(·) is the activation function, let H be the output of the data in the noise adaptive training set, then The columns represent the relative position of the input x1' to x N 'The output vector of the hidden neuron, the row represents the output vector relative to the input x j The output of the hidden layer of the ELM model, that is, the final output of the single hidden layer feedforward neural network is Represents a classifier. The multi-layer integrated ELM model structure is as follows Figure 5 As shown in the figure, in a multi-layer ensemble learning model, there are usually multiple levels of ensemble learning models. Each level of ensemble model will accept the output of the previous level model as input, and further process and optimize it. The final output result is given by the top-level ensemble learning model. That is, the output result of the optimal classifier is selected as the output of the above multi-layer ensemble detection model.

[0061] In order to improve the detection performance of the multi-layer ensemble learning model, in an optional implementation, the above step S403 includes:

[0062] Step S4031, training all the above classifiers using an integrated classifier to obtain training results corresponding to each of the above classifiers;

[0063] Step S4032, verifying all the above training results, and determining the performance ranking of each of the above classifiers, wherein the above performance ranking is used to represent the performance ranking of the above classifier in different evaluation metrics;

[0064] Step S4033, calculating the average ranking of each of the above classifiers according to the above performance ranking of each of the above classifiers;

[0065] Step S4034: generating the above classifier sequence according to the above average ranking.

[0066] In the above embodiment, when the multiple groups of classifiers output by the ELM model are combined and optimized, the traditional voting or stacking method has certain defects. For example, when the performance of a classifier is significantly lower than that of other classifiers, it will have a significant impact on the performance of the entire model. To this end, a multi-layer integrated learning model is used to combine and optimize the ELM model classifiers, thereby improving the adverse effects of the "bad value" classifier. The multi-layer integrated ELM model structure is as follows Figure 5 As shown. First, multiple classifiers are trained in sequence using an integrated classifier. At the same time, the output results of all integrated classifiers in the first layer are verified on the validation set to compare the relative performance of different classifiers. Similarly, in the integrated learning of the next layer, the results output by the integrated classifiers of the previous layer are trained in sequence using the integrated classifier. After the above process is completed, all classifiers output by the next layer are ranked and counted, that is, each classifier is ranked from the best performance to the worst performance, so as to determine the performance index of each classifier in different evaluation metrics. Further, according to the average ranking of each classifier in multiple evaluation metrics, the integrated learning model with the highest average ranking is tested on the test set to obtain the best classifier sequence. Therefore, the multi-layer integrated learning model can eliminate classifiers with poor performance persistence, thereby improving the model training effect.

[0067] In order to accurately determine the category of malicious behavior, in an optional implementation, the above step S204 includes:

[0068] Step S2041, using the above transformer model to extract features from malicious data to obtain multimodal data;

[0069] Step S2042, using the encoder in the transformer model to encode the multimodal data to obtain a multimodal feature sequence, where the multimodal feature sequence is the output result of the last layer encoder in the transformer model;

[0070] Step S2043, performing a linear transformation on the multimodal feature sequence to obtain a multimodal feature vector, wherein the multimodal feature vector is used to represent the probability that the malicious behavior belongs to each of the above categories;

[0071] Step S2044: Determine the category corresponding to the maximum value in the multimodal feature vector as the category of the malicious behavior.

[0072] In the above embodiment, after the network behavior is detected by a multi-layer integrated learning model, the malicious behavior is finely classified. The model uses the transformer model as the main network, and adopts multiple transform models to extract features of the data in which the malicious behavior is detected, and then the knowledge is enhanced through the representation dictionary. The extracted various data features are merged as multimodal embeddings, that is, the above multimodal data. The multimodal embedding is passed into the Transformer encoder for encoding to obtain the above multimodal feature sequence. The core of the Transformer encoder is the self-attention mechanism. First, three learnable linear transformation matrices W are used q , W k , W v The multimodal input is mapped into corresponding vectors Q, K and V, and then the attention weights between each feature and other features in the multimodal feature sequence are calculated through Q and K, and finally the attention weights are combined with V n Multiply them together to get the output of the Transformer encoder. Among them, Q n =W q ·F n-1 , K n =W k ·F n-1 、V n =W v ·F n-1 are the matrices corresponding to the vectors Q, K, and V used by the nth Transformer encoder for self-attention operations, and F n-1 represents the output of the n-1th layer of the Transformer model, F n represents the output of the nth layer of the Transformer model, F 1 represents the initial multimodal input, d t is the dimension of vector K, divided by This ensures that the value range of the dot product is within an appropriate range, avoiding the problem of excessive or small gradients due to large dimensions, which helps improve the training efficiency and stability of the model. The fused multimodal feature sequence is the output F of the last layer of Transformer encoder. N ={f1,f2,...,f nt+ni}, F N ∈R(nt+ni)×dt, where nt+ni is F N The dimension of f1 is F N The first column vector of F N The second column vector, F N The meanings of the other parameters in are similar. Since each Token in the multimodal embedding performs self-attention calculations with other Tokens, it can simultaneously capture the internal effects of the modalities and the mapping relationship between the modalities, dynamically adjust the weights of each modal feature, and more reasonably distribute the attention weights. The fused multimodal feature vector cannot directly classify malicious behaviors. Therefore, a simple attention network is used to obtain the final multimodal representation for classification, which is calculated according to the fourth, fifth, and sixth formulas in turn. The fourth formula is a′ r =ReLU(f r W1+b1)W2+b2, ReLU represents the activation function, f r Indicates F N ={f1,f2,...,f nt+ni}, W1, W2 are weight matrices of linear transformation, b1, b2 are bias matrices of linear transformation, a′ r represents the output of each layer in the attention network. The attention network has multiple attention layers. The fifth formula is Among them, a r Represents a′ r The value after the exp function calculation is the sixth formula: f represents the softmax classifier, Z∈R1×dt, and Z represents the feature vector. Next, the feature vector is input into the fully connected layer, and then the Softmax classifier is used to complete the construction of the classification part. The calculation process is Z′=ReLU(ZW3+b3), W3 and b3 are the weight matrix and bias matrix of the linear transformation respectively, and Z′ represents the final output of the attention network. After passing through the classification layer, the probability vector of the malicious behavior category is output, that is, the above-mentioned multimodal feature vector, and the calculation expression is represents the output vector of each column in Z′, P represents the vector of probabilities belonging to each malicious behavior, and the malicious behavior category with the highest probability is the category of the above malicious behavior.

[0073] In order to perform fine-grained classification of malicious behaviors, in an optional implementation manner, the above step S2041 includes:

[0074] Step S20411, using the Embedding layer to transform the malicious data to obtain a corresponding high-dimensional data vector;

[0075] Step S20413, inputting all the above high-dimensional data vectors into the above Encoder layer for encoding to obtain multiple text features;

[0076] Step S20413, merging the multiple text features mentioned above to obtain the multimodal data mentioned above.

[0077] In the above embodiment, the transformer model can be mainly divided into two parts: the Embedding layer and the Encoder layer. The Embedding layer converts words into word embeddings, which are then input into the Encoder layer for encoding to obtain text features, and knowledge enhancement is performed in the Embedding layer. According to the third formula, the extracted multiple different text features are merged to obtain the above multimodal data as multimodal embedding. The above third formula is Multimodal Embedding = Concat (T, I), T, I are different text features, Concat () represents the merging function, and Multimodal Embedding is the above multimodal data.

[0078] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0079] The embodiment of the present application also provides a malicious behavior identification device for an electric power network. It should be noted that the malicious behavior identification device for an electric power network in the embodiment of the present application can be used to execute the malicious behavior identification method for an electric power network provided in the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation in hardware, or a combination of software and hardware, is also possible and conceivable.

[0080] The following is an introduction to the malicious behavior identification device for the power network provided in an embodiment of the present application.

[0081] Figure 6 is a structural block diagram of a malicious behavior identification device for a power network according to an embodiment of the present application. Figure 6 As shown, the device comprises:

[0082] The acquisition unit 10 is used to acquire all network traffic data, the above network traffic data consists of multiple power variable information and multiple category labels, the above power variable information corresponds to the above category labels one by one, the above power variable information at least includes power load data, power supply data and current data, and the above category label is used to indicate the category to which the corresponding above power variable information belongs.

[0083] Specifically, in the power system network transmission, data presents diversified modes, such as power load data, power supply data, power flow data, voltage data, system log data, etc. These data are collected and processed through communication networks and sensor devices to support the monitoring, control and management of the power system. All network traffic data is obtained and represented in a specific format, such as (x i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) is the power variable information, y i is the category label corresponding to the power variable information.

[0084] The reconstruction unit 20 is used to reconstruct the features of the above-mentioned network traffic data using an improved adaptive elastic network method to extract important feature data. The above-mentioned improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data. The above-mentioned important feature data at least includes the frequency, time period, source and destination of the communication.

[0085] Specifically, the significance of feature reconstruction is to obtain more flexible feature information through raw data, thereby improving the sensitivity of the data and enhancing the analytical capabilities of model training and classification. In addition, in machine learning problems, if the training includes too many features, it will consume a lot of computational overhead and is prone to overfitting, resulting in a decrease in model performance. In order to reduce the impact of high-dimensional learning problems, an improved adaptive elastic network method is used to select features, which can extract relatively important features from a large number of features, such as the frequency of communication, the time period of communication, the source and destination of communication, and other information. Abnormal communication patterns may indicate malicious behavior.

[0086] The detection unit 30 is used to input the above-mentioned important feature data into a multi-layer integrated detection model, and output malicious behavior. The above-mentioned multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above-mentioned noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing.

[0087] Specifically, the above important feature data is input into the multi-layer integrated detection model, and the malicious behavior is output. It should also be noted that the above important feature data needs to be preprocessed before being input into the model. Data normalization is a basic operation of data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution of gradient search. After the model is calculated, the malicious behavior is output.

[0088] The classification unit 40 is used to perform fine-grained classification on the malicious behavior based on the transformer model to obtain the category of the malicious behavior.

[0089] Specifically, the malicious behaviors are finely classified based on the transformer model to obtain the categories of the malicious behaviors. The transformer module is used to extract features of network traffic, device status, and operation behavior in the data corresponding to the malicious behaviors, and the features of the extracted offspring are mapped through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, improving the security and stability of the power system network, and providing a more comprehensive, efficient and accurate solution for the security detection of the power system network.

[0090] in addition, Figure 3 The process of detecting and identifying malicious behaviors in power networks is demonstrated. First, the data in the network traffic is featured, and then the features are processed through feature reconstruction, feature normalization, particle swarm optimization algorithm and other methods. Finally, a multi-layer integrated ELM learning model is used to detect malicious behaviors and determine whether they are malicious behaviors. If they are malicious behaviors, a transformer-based classification model is used for fine-grained classification.

[0091] In this embodiment, an acquisition unit is used to acquire all network traffic data, the network traffic data is composed of multiple power variable information and multiple category labels, the power variable information corresponds to the category labels one by one, the power variable information at least includes power load data, power supply data and current data, and the category label is used to indicate the category to which the corresponding power variable information belongs; a reconstruction unit is used to perform feature reconstruction on the network traffic data using an improved adaptive elastic network method to extract important feature data, the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, the important feature data at least includes the frequency, time period, source and destination of communication; a detection unit is used to input the important feature data into a multi-layer integrated detection model, and output malicious behavior, the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; a classification unit is used to perform fine-grained classification on the malicious behavior based on a transformer model to obtain the category of the malicious behavior. The present application first receives the original network traffic data packets, extracts important network traffic features from the original network traffic data packets in the preprocessing stage, and prepares the corresponding normalized feature vectors. The detection and identification are divided into two stages: building a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features of the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the features of the extracted offspring through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, and determining the category of malicious behaviors; the present application solves the problem in the prior art that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

[0092] In order to avoid overfitting of the multi-layer integrated detection model, in an optional implementation manner, the reconstruction unit includes:

[0093] The construction module uses the first formula to construct an adaptive elastic network regression model. The above first formula is β0 represents the intercept coefficient, β j represents the regression coefficient, i represents the number of the above power variable information in the above network traffic data, j represents the number of the power data in the above power variable information, and x ij represents the jth power data in the i-th power variable information, and p represents the total number of the corresponding power data in the power variable information;

[0094] The first calculation module calculates the regression loss value using the above-mentioned adaptive elastic network regression model according to the second formula. The above-mentioned second formula is: in, N represents the total number of the above power variable information in the above network traffic data, λ * 1 is a fixed non-negative real number, |...| represents the L1 norm element, |...2 represents the L2 norm element, λ2 is an arbitrary non-negative constant, γ is a positive real number, is the above regression loss value, express The L1 norm element of , represents the adjustment coefficient;

[0095] The first determination module determines the corresponding network traffic data as the important feature data when the regression loss value is greater than a set loss threshold.

[0096] In the above embodiment, the significance of feature reconstruction is to obtain more flexible feature information through the original data, thereby improving the sensitivity of the data and enhancing the analytical ability of model training and classification. In addition, in machine learning problems, if the training includes too many features, it will consume a lot of computing overhead and easily overfit, resulting in a decrease in model performance. In order to reduce the impact of high-dimensional learning problems, an improved adaptive elastic network method is used to select features. Let the network traffic data be represented as (x i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) is the power variable information, y i is the category label corresponding to the power variable information. At this time, the adaptive elastic network regression model can be constructed as follows: Regularization terms such as L1 regularization and L2 regularization are introduced to prevent overfitting and improve the generalization ability of the model. The L2 penalty is combined with the weighted L1 penalty to calculate the final regression loss by penalizing the squared error loss. The regression loss value is calculated using the second formula above. L1 penalty and L2 penalty usually refer to a penalty term used in machine learning to help the model avoid overfitting. According to the above calculation, important features with relatively high importance can be extracted from a large number of features, that is, the above-mentioned important feature data, such as the frequency of communication, the time period of communication, the source and destination of communication, and other information. Abnormal communication patterns may indicate malicious behavior. Further, these important feature data are combined into feature vectors and substituted into the training model to obtain more accurate classification results while ensuring low computing and operating costs.

[0097] In order to effectively improve the adaptability of the model to noisy data, in an optional implementation manner, the device further includes:

[0098] A normalization unit is used to normalize the network traffic sample feature data using a data normalization method before inputting the important feature data into the multi-layer integrated detection model and outputting the malicious behavior to obtain normalized feature data;

[0099] A calculation unit, for calculating an outlier score for each of the normalized feature data, wherein the outlier score indicates a degree of abnormality of the normalized feature data relative to other normalized feature data;

[0100] A determination unit, when the outlier score is greater than a set score threshold, determines the corresponding normalized feature data as noise data;

[0101] The training unit trains the noise data and normal data based on the PSO-K-means clustering algorithm so that the noise data is enhanced during the training process to form the noise adaptive training set. The normal data is the normalized feature data corresponding to the outlier score being less than or equal to the set score threshold.

[0102] In the above embodiment, the above network traffic sample feature data needs to be preprocessed before being sent to the model training. Data normalization is a basic operation of data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution of gradient search. The data normalization method mainly includes min-max and z-score normalization operations. Taking the z-score normalization operation as an example, the z-score normalization operation is specifically described as: Where X is the above normalized feature data after z-score normalization, x is the network traffic sample feature data, μ is the mean of all network traffic sample feature data, and σ is the standard deviation of all network traffic sample feature data. The noise problem in the data set has always been an important problem affecting the accuracy of classification or regression. Generally, there are two main types of noise in power data, namely, category noise and attribute noise. Category noise is data with incorrect class labels. Attribute noise is data with incorrect attribute values. Considering that in actual situations, the probability value of data points located in sparsely distributed areas of data is lower than that of data in dense areas in the data space. Therefore, these noise data can be regarded as outliers. To this end, a noise data processing method based on the PSO-K means (PSO-Kmeans) clustering algorithm based on the particle swarm optimization (PSO) algorithm is used. The method first calculates the outlier score of each normalized feature data, which indicates the degree of abnormality of each normalized feature data relative to other normalized feature data. By setting a threshold, that is, the above-mentioned set score threshold, the outlier score above the threshold indicates that it may be noise data. According to the set score threshold, the normalized feature data with outlier scores higher than the set score threshold are identified and detected as noise data. Subsequently, these noise data will be enhanced in the training set to form a noise adaptive training set. The noise adaptive training set has more noise data than the original data set. This will enhance the adaptability of the model to noise data and alleviate the overfitting problem of the model to a certain extent. The execution process of the PSOK-means algorithm is as follows Figure 4 shown.

[0103] In order to provide a model basis for constructing a multi-layer integrated detection model, in an optional implementation, the device further includes:

[0104] An initialization unit, used to perform fine-grained classification of the malicious behavior based on a transformer model, and initialize model parameters before obtaining the category of the malicious behavior, wherein the model parameters at least include the number of input neurons, the number of hidden neurons, the number of output neurons, and the deviation of the hidden neurons of the single hidden layer feedforward neural network, the input neurons are neurons of the input layer of the single hidden layer feedforward neural network, the hidden neurons are neurons of the hidden layer of the single hidden layer feedforward neural network, and the output neurons are neurons of the hidden layer of the single hidden layer feedforward neural network;

[0105] An input unit, used to input all sample data into the plurality of the above-mentioned single hidden layer feedforward neural networks to obtain a classifier corresponding to each of the above-mentioned single hidden layer feedforward neural networks, wherein the above-mentioned sample data is the above-mentioned network traffic sample data of any group in the above-mentioned sample data set;

[0106] An optimization unit, used for performing combined optimization on all the above classifiers to obtain a classifier sequence, wherein the above classifier sequence is a sequence obtained by sorting the performance of all the above classifiers from high to low;

[0107] A selection unit is used to select the output result of the optimal classifier as the output of the above-mentioned multi-layer integrated detection model, the above-mentioned optimal classifier is the first classifier in the above-mentioned classifier sequence, and the above-mentioned output result is malicious behavior or non-malicious behavior.

[0108] In the above embodiment, the ELM model is a single-hidden layer feedforward neural network (SLFN) model, which can randomly select input weights and implicit biases without any adjustment. Initialize the parameters in the single hidden layer feedforward neural network, let A be the number of input neurons, that is, the number of important input features, let B be the number of hidden neurons; C is the number of output neurons, that is, the number of output categories, and at the same time, let the input weight matrix be K = [k1, k2, ..., k j ,...,k B ], where k j =[k j1 ,k j2 ,...,k jn ] is the vector connecting A input neurons and the jth hidden neuron, b=[b1,b2,...,b j ,....,b B ] is the bias vector of the hidden neuron, b j is the bias of the jth hidden neuron. Any input data in the model is x i The output of ' is: h(x i ')=G(Kx i '+b), G(·) is the activation function, let H be the output of the data in the noise adaptive training set, then The columns represent the relative position of the input x1' to x N 'The output vector of the hidden neuron, the row represents the output vector relative to the input x j The output of the hidden layer of the ELM model, that is, the final output of the single hidden layer feedforward neural network is Represents a classifier. The multi-layer integrated ELM model structure is as follows Figure 5 As shown in the figure, in a multi-layer ensemble learning model, there are usually multiple levels of ensemble learning models. Each level of ensemble model will accept the output of the previous level model as input, and further process and optimize it. The final output result is given by the top-level ensemble learning model. That is, the output result of the optimal classifier is selected as the output of the above multi-layer ensemble detection model.

[0109] In order to improve the detection performance of the multi-layer ensemble learning model, in an optional implementation, the optimization unit includes:

[0110] A training module, which trains all the above classifiers using an integrated classifier to obtain training results corresponding to each of the above classifiers;

[0111] A verification module verifies all the above training results and determines the performance ranking of each of the above classifiers, where the above performance ranking is used to represent the performance ranking of the above classifiers in different evaluation metrics;

[0112] A second calculation module calculates an average ranking of each of the above classifiers according to the above performance ranking of each of the above classifiers;

[0113] A generation module generates the above classifier sequence according to the above average ranking.

[0114] In the above embodiment, when the multiple groups of classifiers output by the ELM model are combined and optimized, the traditional voting or stacking method has certain defects. For example, when the performance of a classifier is significantly lower than that of other classifiers, it will have a significant impact on the performance of the entire model. To this end, a multi-layer integrated learning model is used to combine and optimize the ELM model classifiers, thereby improving the adverse effects of the "bad value" classifier. The multi-layer integrated ELM model structure is as follows Figure 5 As shown. First, multiple classifiers are trained in sequence using an integrated classifier. At the same time, the output results of all integrated classifiers in the first layer are verified on the validation set to compare the relative performance of different classifiers. Similarly, in the integrated learning of the next layer, the results output by the integrated classifiers of the previous layer are trained in sequence using the integrated classifier. After the above process is completed, all classifiers output by the next layer are ranked and counted, that is, each classifier is ranked from the best performance to the worst performance, so as to determine the performance index of each classifier in different evaluation metrics. Further, according to the average ranking of each classifier in multiple evaluation metrics, the integrated learning model with the highest average ranking is tested on the test set to obtain the best classifier sequence. Therefore, the multi-layer integrated learning model can eliminate classifiers with poor performance persistence, thereby improving the model training effect.

[0115] In order to accurately determine the category of malicious behavior, in an optional implementation, the classification unit includes:

[0116] The feature extraction module uses the above transformer model to extract features from malicious data and obtain multimodal data;

[0117] An encoding module, which encodes the multimodal data using the encoder in the transformer model to obtain a multimodal feature sequence, where the multimodal feature sequence is the output result of the last layer encoder in the transformer model;

[0118] A linear transformation module performs a linear transformation on the multimodal feature sequence to obtain a multimodal feature vector, wherein the multimodal feature vector is used to represent the probability that the malicious behavior belongs to each of the above categories;

[0119] The second determination module determines the category corresponding to the maximum value in the multimodal feature vector as the category of the malicious behavior.

[0120] In the above embodiment, after the network behavior is detected by a multi-layer integrated learning model, the malicious behavior is finely classified. The model uses the transformer model as the main network, and adopts multiple transform models to extract features of the data in which the malicious behavior is detected, and then the knowledge is enhanced through the representation dictionary. The extracted various data features are merged as multimodal embeddings, that is, the above multimodal data. The multimodal embedding is passed into the Transformer encoder for encoding to obtain the above multimodal feature sequence. The core of the Transformer encoder is the self-attention mechanism. First, three learnable linear transformation matrices W are used q , W k , W v The multimodal input is mapped into corresponding vectors Q, K and V, and then the attention weights between each feature and other features in the multimodal feature sequence are calculated through Q and K, and finally the attention weights are combined with V n Multiply them together to get the output of the Transformer encoder. Among them, Q n =W q ·F n-1 , K n =W k ·F n-1 、V n =W v ·F n-1 are the matrices corresponding to the vectors Q, K, and V used by the nth Transformer encoder for self-attention operations, and F n-1 represents the output of the n-1th layer of the Transformer model, F n represents the output of the nth layer of the Transformer model, F 1 represents the initial multimodal input, d t is the dimension of vector K, divided by This ensures that the value range of the dot product is within an appropriate range, avoiding the problem of excessive or small gradients due to large dimensions, which helps improve the training efficiency and stability of the model. The fused multimodal feature sequence is the output F of the last layer of Transformer encoder. N ={f1,f2,...,f nt+ni}, F N ∈R(nt+ni)×dt, where nt+ni is F N The dimension of f1 is F N The first column vector of F N The second column vector, F N The meanings of the other parameters in are similar. Since each Token in the multimodal embedding performs self-attention calculations with other Tokens, it can simultaneously capture the internal effects of the modalities and the mapping relationship between the modalities, dynamically adjust the weights of each modal feature, and more reasonably distribute the attention weights. The fused multimodal feature vector cannot directly classify malicious behaviors. Therefore, a simple attention network is used to obtain the final multimodal representation for classification, which is calculated according to the fourth, fifth, and sixth formulas in turn. The fourth formula is a′ r =ReLU(f r W1+b1)W2+b2, ReLU represents the activation function, f r Indicates F N ={f1,f2,...,f nt+ni}, W1, W2 are weight matrices of linear transformation, b1, b2 are bias matrices of linear transformation, a′ r represents the output of each layer in the attention network. The attention network has multiple attention layers. The fifth formula is Among them, a r Represents a′ r The value after the exp function calculation is the sixth formula: f represents the softmax classifier, Z∈R1×dt, and Z represents the feature vector. Next, the feature vector is input into the fully connected layer, and then the Softmax classifier is used to complete the construction of the classification part. The calculation process is Z′=ReLU(ZW3+b3), W3 and b3 are the weight matrix and bias matrix of the linear transformation respectively, and Z′ represents the final output of the attention network. After passing through the classification layer, the probability vector of the malicious behavior category is output, that is, the above-mentioned multimodal feature vector, and the calculation expression is represents the output vector of each column in Z′, P represents the vector of probabilities belonging to each malicious behavior, and the malicious behavior category with the highest probability is the category of the above malicious behavior.

[0121] In order to perform fine-grained classification of malicious behaviors, in an optional implementation, the feature extraction module includes:

[0122] The conversion submodule uses the above Embedding layer to convert the above malicious data to obtain the corresponding high-dimensional data vector;

[0123] The encoding submodule inputs all the above high-dimensional data vectors into the above Encoder layer for encoding to obtain a variety of text features;

[0124] The merging submodule merges the multiple text features mentioned above to obtain the multimodal data mentioned above.

[0125] In the above embodiment, the transformer model can be mainly divided into two parts: the Embedding layer and the Encoder layer. The Embedding layer converts words into word embeddings, which are then input into the Encoder layer for encoding to obtain text features, and knowledge enhancement is performed in the Embedding layer. According to the third formula, the extracted multiple different text features are merged to obtain the above multimodal data as multimodal embedding. The above third formula is Multimodal Embedding = Concat (T, I), T, I are different text features, Concat () represents the merging function, and Multimodal Embedding is the above multimodal data.

[0126] The malicious behavior identification device for the power network includes a processor and a memory. The above units are stored in the memory as program units, and the processor executes the above program units stored in the memory to implement corresponding functions. The above modules are all located in the same processor; or, the above modules are located in different processors in any combination.

[0127] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the problem of low accuracy of malicious behavior detection in the prior art due to the limitation of data processing and feature extraction in network malicious behavior detection can be solved by adjusting kernel parameters.

[0128] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0129] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the malicious behavior identification method of the power network.

[0130] Specifically, the malicious behavior identification method of the power network includes:

[0131] Step S201, acquiring all network traffic data, the network traffic data consisting of a plurality of power variable information and a plurality of category tags, the power variable information corresponding to the category tags one by one, the power variable information at least including power load data, power supply data and current data, the category tags are used to indicate the category to which the corresponding power variable information belongs;

[0132] Step S202, using an improved adaptive elastic network method to reconstruct features of the network traffic data to extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, and the important feature data at least includes the frequency, time period, source and destination of the communication;

[0133] Step S203, inputting the above-mentioned important feature data into a multi-layer integrated detection model, and outputting malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing;

[0134] Step S204: fine-grained classification of the malicious behavior is performed based on the transformer model to obtain the category of the malicious behavior.

[0135] An embodiment of the present invention provides a processor, and the processor is used to run a program, wherein the malicious behavior identification method of the power network is executed when the program is running.

[0136] Specifically, the malicious behavior identification method of the power network includes:

[0137] Step S201, acquiring all network traffic data, the network traffic data consisting of a plurality of power variable information and a plurality of category tags, the power variable information corresponding to the category tags one by one, the power variable information at least including power load data, power supply data and current data, the category tags are used to indicate the category to which the corresponding power variable information belongs;

[0138] Step S202, using an improved adaptive elastic network method to reconstruct features of the network traffic data to extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, and the important feature data at least includes the frequency, time period, source and destination of the communication;

[0139] Step S203, inputting the above-mentioned important feature data into a multi-layer integrated detection model, and outputting malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing;

[0140] Step S204: fine-grained classification of the malicious behavior is performed based on the transformer model to obtain the category of the malicious behavior.

[0141] The embodiment of the present invention provides a device, which includes a processor, a memory, and a program stored in the memory and can be run on the processor. When the processor executes the program, at least the following steps are implemented: (method claim steps, exclusive rights). The device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0142] Step S201, acquiring all network traffic data, the network traffic data consisting of a plurality of power variable information and a plurality of category tags, the power variable information corresponding to the category tags one by one, the power variable information at least including power load data, power supply data and current data, the category tags are used to indicate the category to which the corresponding power variable information belongs;

[0143] Step S202, using an improved adaptive elastic network method to reconstruct features of the network traffic data to extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, and the important feature data at least includes the frequency, time period, source and destination of the communication;

[0144] Step S203, inputting the above-mentioned important feature data into a multi-layer integrated detection model, and outputting malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing;

[0145] Step S204: fine-grained classification of the malicious behavior is performed based on the transformer model to obtain the category of the malicious behavior.

[0146] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0147] Step S201, acquiring all network traffic data, the network traffic data consisting of a plurality of power variable information and a plurality of category tags, the power variable information corresponding to the category tags one by one, the power variable information at least including power load data, power supply data and current data, the category tags are used to indicate the category to which the corresponding power variable information belongs;

[0148] Step S202, using an improved adaptive elastic network method to reconstruct features of the network traffic data to extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, and the important feature data at least includes the frequency, time period, source and destination of the communication;

[0149] Step S203, inputting the above-mentioned important feature data into a multi-layer integrated detection model, and outputting malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing;

[0150] Step S204: fine-grained classification of the malicious behavior is performed based on the transformer model to obtain the category of the malicious behavior.

[0151] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0152] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0153] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0154] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0155] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0156] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0157] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0158] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0159] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0160] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0161] 1) The method for identifying malicious behavior in the power network of the present application first receives the original network traffic data packets, extracts important network traffic features from the original network traffic data packets in the preprocessing stage, and prepares the corresponding normalized feature vectors. The detection and identification are divided into two stages: building a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features of the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the features of the extracted offspring through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, and determining the category of malicious behavior; the present application solves the problem in the prior art that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

[0162] 2) The malicious behavior identification device for the power network of the present application first receives the original network traffic data packets, extracts important network traffic features from the original network traffic data packets in the preprocessing stage, and prepares the corresponding normalized feature vectors. The detection and identification are divided into two stages: building a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features of the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the features of the extracted offspring through a multi-layer fully connected network, mapping different data to the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in the power system network, and determining the category of malicious behavior; The present application solves the problem in the prior art that network malicious behavior detection is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

[0163] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for identifying malicious behavior in a power network, characterized in that: include: Acquire all network traffic data, wherein the network traffic data consists of a plurality of power variable information and a plurality of category tags, wherein the power variable information corresponds to the category tags one by one, the power variable information at least includes power load data, power supply data and current data, and the category tags are used to indicate the category to which the corresponding power variable information belongs; Using an improved adaptive elastic network method to reconstruct the network traffic data, and extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract highly important features from a large amount of data, and the important feature data at least includes the frequency, time period, source and destination of the communication; The important feature data is input into a multi-layer integrated detection model, and malicious behavior is outputted. The multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; The malicious behavior is finely classified based on the transformer model to obtain the category of the malicious behavior.

2. The method according to claim 1, characterized in that The improved adaptive elastic network method is used to reconstruct the network traffic data and extract important feature data, including: The adaptive elastic network regression model is constructed using the first formula, where the first formula is β0 represents the intercept coefficient, β j represents the regression coefficient, i represents the number of the power variable information in the network traffic data, j represents the number of the power data in the power variable information, and x ij express The jth power data in the i-th power variable information, p represents the total number of the corresponding power data in the power variable information; The regression loss value is calculated using the adaptive elastic network regression model according to the second formula, and the second formula is: in, N represents the total number of power variable information in the network traffic data, λ * 1 is a fixed non-negative real number, |...| represents the L1 norm element, |...|2 represents the L2 norm element, λ2 is an arbitrary non-negative constant, γ is a positive real number, is the regression loss value, express The L1 norm element of , represents the adjustment coefficient; When the regression loss value is greater than a set loss threshold, the corresponding network traffic data is determined as the important feature data.

3. The method according to claim 1, characterized in that Before inputting the important feature data into the multi-layer integrated detection model to output the malicious behavior, the method further includes: Using a data normalization method to normalize the network traffic sample characteristic data to obtain normalized characteristic data; Calculating an outlier score for each of the normalized feature data, wherein the outlier score indicates the degree of abnormality of the normalized feature data relative to other normalized feature data; When the outlier score is greater than a set score threshold, the corresponding normalized feature data is determined as noise data; Based on the PSO-K-means clustering algorithm, these noise data and normal data are trained so that the noise data is enhanced during the training process to form the noise adaptive training set, and the normal data is the normalized feature data corresponding to the outlier score being less than or equal to the set score threshold.

4. The method according to claim 1, characterized in that: Before inputting the important feature data into the multi-layer integrated detection model and outputting the malicious behavior, the method further includes: Initialize model parameters, wherein the model parameters at least include the number of input neurons, the number of hidden neurons, the number of output neurons and the bias of the hidden neurons of the single hidden layer feedforward neural network, the input neurons are neurons of the input layer in the single hidden layer feedforward neural network, the hidden neurons are neurons of the hidden layer in the single hidden layer feedforward neural network, and the output neurons are neurons of the hidden layer in the single hidden layer feedforward neural network; Inputting all sample data into a plurality of the single hidden layer feedforward neural networks to obtain a classifier corresponding to each of the single hidden layer feedforward neural networks, wherein the sample data is the network traffic sample data of any group in the sample data set; Performing combined optimization on all the classifiers to obtain a classifier sequence, wherein the classifier sequence is a sequence obtained by sorting the performance of all the classifiers from high to low; The output result of the optimal classifier is selected as the output of the multi-layer integrated detection model, the optimal classifier is the first classifier in the classifier sequence, and the output result is malicious behavior or non-malicious behavior.

5. The method according to claim 4, characterized in that All the classifiers are combined and optimized to obtain a classifier sequence, including: Training all the classifiers using an integrated classifier to obtain training results corresponding to each of the classifiers; Verifying all the training results to determine the performance ranking of each of the classifiers, wherein the performance ranking is used to represent the performance ranking of the classifier in different evaluation metrics; According to the performance ranking of each of the classifiers, calculating the average ranking of each of the classifiers; The classifier sequence is generated according to the average ranking.

6. The method according to claim 1, characterized in that The malicious behavior is finely classified based on the transformer model to obtain the category of the malicious behavior, including: The transformer model is used to extract features from malicious data to obtain multimodal data; Encoding the multimodal data using an encoder in the transformer model to obtain a multimodal feature sequence, where the multimodal feature sequence is an output result of the last layer of encoder in the transformer model; Performing a linear transformation on the multimodal feature sequence to obtain a multimodal feature vector, wherein the multimodal feature vector is used to represent the probability that the malicious behavior belongs to each of the categories; The category corresponding to the maximum value in the multimodal feature vector is determined as the category of the malicious behavior.

7. The method according to claim 1, characterized in that The transformer model includes an Embedding layer and an Encoder layer. The transformer model is used to extract features from malicious data to obtain multimodal data, including: Using the Embedding layer to transform the malicious data to obtain a corresponding high-dimensional data vector; Input all the high-dimensional data vectors into the Encoder layer for encoding to obtain multiple text features; A plurality of the text features are combined to obtain the multimodal data.

8. A malicious behavior identification device for a power network, characterized in that: The device comprises: an acquisition unit, configured to acquire all network flow data, wherein the network flow data is composed of a plurality of power variable information and a plurality of category tags, wherein the power variable information corresponds to the category tags one by one, the power variable information at least includes power load data, power supply data and current data, and the category tags are used to indicate the category to which the corresponding power variable information belongs; a reconstruction unit, configured to perform feature reconstruction on the network traffic data by adopting an improved adaptive elastic network method to extract important feature data, wherein the improved adaptive elastic network method is a method of introducing a feature selection method into an elastic network method to extract features with high importance from a large amount of data, wherein the important feature data at least includes a frequency, a time period, a source and a destination of the communication; A detection unit, used to input the important feature data into a multi-layer integrated detection model, and output malicious behavior, wherein the multi-layer integrated detection model is a convergence model obtained by inputting a noise adaptive training set into multiple single hidden layer feedforward neural networks for training, and the noise adaptive training set is a data set composed of multiple groups of network traffic sample feature data after noise processing; A classification unit is used to perform fine-grained classification on the malicious behavior based on a transformer model to obtain a category of the malicious behavior.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images