Malicious behavior identification method and identification device for power network

Abstract

The application provides a malicious behavior identification method and identification device of a power network, the method comprising: acquiring all network traffic data, the network traffic data being composed of multiple power variable information and multiple category labels, the power variable information at least including power load data, power supply data and current data, and the category label being used for representing a category to which the corresponding power variable information belongs; adopting an improved adaptive elastic network method to perform feature reconstruction on the network traffic data, and extracting important feature data; inputting the important feature data into a multi-layer integrated detection model, and outputting to obtain a malicious behavior; and performing fine-grained classification on the malicious behavior based on a transformer model, and obtaining a category of the malicious behavior. The application solves the problem that the network malicious behavior detection in the prior art is limited by data processing and feature extraction, resulting in low accuracy of malicious behavior detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method, device, computer-readable storage medium, and computer program product for identifying malicious behavior in power networks. Background Technology

[0002] Detection of malicious behavior in power grids mainly involves two parts: first, detecting power grid attacks; and second, fine-grained identification of detected malicious behavior. Finding better feature extraction methods is currently a hot research topic in existing malicious behavior detection algorithms.

[0003] The development of power grid attack detection algorithms can be traced back to early simple detection techniques based on rules and statistical methods. It subsequently evolved into using machine learning algorithms such as Support Vector Machines (SVM) and decision trees for network anomaly detection. In recent years, with the rapid development of deep learning technology, deep learning-based power grid attack detection algorithms have received widespread attention. However, these algorithms are limited by their feature extraction capabilities, relying on manually selected features and rules. They struggle to handle large-scale and high-dimensional data, require significant manual intervention and parameter tuning, are unable to capture complex attack patterns, and lack adaptability to novel attacks. Summary of the Invention

[0004] The main objective of this application is to provide a method, device, computer-readable storage medium, and computer program product for identifying malicious behavior in power networks, so as to at least solve the problem that the accuracy of malicious behavior detection in the prior art is low due to limitations in data processing and feature extraction.

[0005] To achieve the above objectives, according to one aspect of this application, a method for identifying malicious behavior in a power network is provided, comprising: acquiring all network traffic data, wherein the network traffic data consists of multiple power variable information and multiple category labels, wherein the power variable information corresponds one-to-one with the category labels, and the power variable information includes at least power load data, power supply data, and current data, and the category labels are used to indicate the category to which the corresponding power variable information belongs; reconstructing features of the network traffic data using an improved adaptive elastic network method to extract important feature data, wherein the improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to obtain a method for extracting highly important features from a large amount of data, and the important feature data includes at least the frequency, time period, source, and destination of communication; inputting the important feature data into a multilayer ensemble detection model to output malicious behavior, wherein the multilayer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training, and the noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing; and performing fine-grained classification of the malicious behavior based on a transformer model to obtain the category of the malicious behavior.

[0006] Optionally, an improved adaptive resilient network method is used to reconstruct the network traffic data and extract important feature data, including: constructing an adaptive resilient network regression model using a first formula, wherein the first formula is... β0 represents the intercept coefficient, β j Let i represent the regression coefficient, j represent the number of the power variable information in the network traffic data, and x represent the number of the power data in the power variable information. ij This represents the j-th power data point in the i-th power variable information, where p represents the total number of corresponding power data points in the power variable information; the regression loss value is calculated using the adaptive elastic network regression model according to the second formula, where the second formula is... in, N represents the total number of power variable information items in the network traffic data, λ * 1 is a fixed non-negative real number, |...| represents L1 norm elements, |...2 represents L2 norm elements, λ2 is an arbitrary non-negative constant, and γ is a positive real number. The regression loss value is... express L1 norm elements, This represents the adjustment coefficient; when the regression loss value is greater than the set loss threshold, the corresponding network traffic data is determined as the important feature data.

[0007] Optionally, before inputting the important feature data into the multi-layer ensemble detection model and outputting malicious behavior, the method further includes: normalizing the network traffic sample feature data using a data normalization method to obtain normalized feature data; calculating the outlier score for each normalized feature data, where the outlier score represents the degree of abnormality of the normalized feature data relative to other normalized feature data; if the outlier score is greater than a set score threshold, identifying the corresponding normalized feature data as noise data; training these noise data and normal data based on the PSO-K mean clustering algorithm to enhance the noise data during training, forming the noise adaptive training set, where the normal data are the normalized feature data corresponding to outlier scores less than or equal to the set score threshold.

[0008] Optionally, before inputting the important feature data into the multilayer ensemble detection model and outputting malicious behavior, the method further includes: initializing model parameters, the model parameters including at least the number of input neurons, the number of hidden neurons, the number of output neurons, and the bias of the hidden neurons in the single hidden layer feedforward neural network, wherein the input neurons are neurons in the input layer of the single hidden layer feedforward neural network, the hidden neurons are neurons in the hidden layer of the single hidden layer feedforward neural network, and the output neurons are neurons in the hidden layer of the single hidden layer feedforward neural network; inputting all sample data into multiple single hidden layer feedforward neural networks to obtain classifiers corresponding to each single hidden layer feedforward neural network, wherein the sample data is network traffic sample data from any group in the sample dataset; performing combined optimization on all the classifiers to obtain a classifier sequence, wherein the classifier sequence is a sequence obtained by sorting the performance of all the classifiers from high to low; selecting the output result of the optimal classifier as the output of the multilayer ensemble detection model, wherein the optimal classifier is the first classifier in the classifier sequence, and the output result is malicious behavior or non-malicious behavior.

[0009] Optionally, the classifiers are combined and optimized to obtain a classifier sequence, including: training all the classifiers using an ensemble classifier to obtain training results for each classifier; validating all the training results to determine the performance ranking of each classifier, the performance ranking representing the performance ranking of the classifier in different evaluation metrics; calculating the average ranking of each classifier based on the performance ranking of each classifier; and generating the classifier sequence based on the average ranking.

[0010] Optionally, the malicious behavior is classified in a fine-grained manner based on the transformer model to obtain the category of the malicious behavior, including: extracting features from the malicious data using the transformer model to obtain multimodal data; encoding the multimodal data using the encoder in the transformer model to obtain a multimodal feature sequence, wherein the multimodal feature sequence is the output of the last layer encoder in the transformer model; performing a linear transformation on the multimodal feature sequence to obtain a multimodal feature vector, wherein the multimodal feature vector is used to represent the probability that the malicious behavior belongs to each of the categories; and determining the category corresponding to the maximum value in the multimodal feature vector as the category of the malicious behavior.

[0011] Optionally, the transformer model includes an embedding layer and an encoder layer. Using the transformer model to extract features from malicious data to obtain multimodal data includes: transforming the malicious data using the embedding layer to obtain a corresponding high-dimensional data vector; inputting all the high-dimensional data vectors into the encoder layer for encoding to obtain multiple text features; and merging the multiple text features to obtain the multimodal data.

[0012] According to another aspect of this application, a malicious behavior identification device for a power network is provided. The device includes: an acquisition unit, configured to acquire all network traffic data, the network traffic data consisting of multiple power variable information and multiple category labels, wherein the power variable information corresponds one-to-one with the category labels, the power variable information including at least power load data, power supply data, and current data, and the category labels indicating the category to which the corresponding power variable information belongs; and a reconstruction unit, configured to perform feature reconstruction on the network traffic data using an improved adaptive elastic network method to extract important feature data, wherein the improved adaptive elastic network method is a method that incorporates features from an elastic network method. A feature selection method is introduced to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source, and destination of communication. A detection unit is used to input the important feature data into a multi-layer ensemble detection model and output malicious behavior. The multi-layer ensemble detection model is a convergent model obtained by training multiple single-hidden-layer feedforward neural networks with a noise adaptive training set as input. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. A classification unit is used to perform fine-grained classification of the malicious behavior based on a transformer model to obtain the category of the malicious behavior.

[0013] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform any of the methods described.

[0014] According to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement any of the methods described.

[0015] Applying the technical solution of this application, in the method for identifying malicious behavior in power networks, firstly, all network traffic data is acquired. This network traffic data consists of multiple power variable information and multiple category labels, with each power variable information corresponding to one of the category labels. The power variable information includes at least power load data, power supply data, and current data, and the category labels represent the category to which the corresponding power variable information belongs. Then, an improved adaptive elastic network method is used to reconstruct the features of the network traffic data, extracting important feature data. This improved adaptive elastic network method introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the communication frequency, time period, source, and destination. Next, the important feature data is input into a multi-layer ensemble detection model, which outputs malicious behavior. This multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. Finally, the malicious behavior is classified in a fine-grained manner based on a transformer model to obtain the category of the malicious behavior. This application first receives raw network traffic data packets and extracts important network traffic features during the preprocessing stage, preparing corresponding normalized feature vectors. The detection and identification process is divided into two stages: first, constructing a multi-layer integrated detection model to determine whether it is malicious behavior; second, after detecting any malicious behavior, using Transform to extract features from network traffic, equipment status, and operational behavior collected in the power grid system. The extracted features are then mapped through a multi-layer fully connected network, mapping different data into the same space, achieving cross-sensor feature fusion and fine-grained identification and classification of malicious behavior in the power system network, thus determining the category of malicious behavior. This application solves the problem of low accuracy in malicious behavior detection in existing technologies due to limitations in data processing and feature extraction. Attached Figure Description

[0016] Figure 1A hardware structure block diagram of a mobile terminal for performing a method for identifying malicious behavior in a power network, according to an embodiment of this application, is shown.

[0017] Figure 2 A flowchart illustrating a method for identifying malicious behavior in a power network according to an embodiment of this application is shown.

[0018] Figure 3 A schematic diagram illustrating a specific process for detecting and identifying malicious behavior in a power network according to an embodiment of this application is shown.

[0019] Figure 4 A flowchart of a PSO-K mean clustering algorithm for a power network according to an embodiment of this application is shown;

[0020] Figure 5 A structural diagram of a multi-layer ensemble learning model provided according to an embodiment of this application is shown;

[0021] Figure 6 A structural block diagram of a malicious behavior identification device for a power network according to an embodiment of this application is shown.

[0022] The above figures include the following reference numerals:

[0023] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] As described in the background section, existing algorithms are limited by their limited feature extraction capabilities. They rely on manually selected features and rules, making it difficult to handle large-scale and high-dimensional data. They also require significant manual intervention and parameter tuning, making it difficult to capture complex attack patterns and lacking adaptability to new types of attacks. To address the problem of low accuracy in network malicious behavior detection due to limitations in data processing and feature extraction, embodiments of this application provide a method, device, computer-readable storage medium, and computer program product for identifying malicious behavior in power networks.

[0028] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0029] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a method of identifying malicious behavior in a power network according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0030] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the device information display method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0031] This embodiment provides a method for identifying malicious behavior in a power network that runs on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] Figure 2 This is a flowchart of a method for identifying malicious behavior in a power network according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0033] Step S201: Obtain all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information and the category labels correspond one-to-one. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0034] Specifically, data transmitted in power system networks exhibits diverse modalities, such as power load data, power supply data, power flow data, voltage data, and system log data. This data is collected and processed through communication networks and sensor devices to support the monitoring, control, and management of the power system. All network traffic data is acquired and represented in a specific format, such as (x... i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) represents electricity variable information, y i This is the category label corresponding to the electricity variable information.

[0035] Step S202: The network traffic data is reconstructed using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication.

[0036] Specifically, the significance of feature reconstruction lies in obtaining more flexible feature information from the original data, thereby improving data sensitivity and enhancing the analytical capabilities of model training and classification. Furthermore, in machine learning problems, training with too many features consumes significant computational overhead and is prone to overfitting, leading to decreased model performance. To mitigate the impact of high-dimensional learning problems, an improved adaptive elastic network approach is employed to select features. This approach extracts relatively important features from a large dataset, such as communication frequency, communication timeframe, and the source and destination of the communication. Abnormal communication patterns may indicate malicious behavior.

[0037] Step S203: Input the above important feature data into the multi-layer ensemble detection model and output the malicious behavior. The above multi-layer ensemble detection model is a convergent model obtained by inputting the noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0038] Specifically, the aforementioned key feature data is input into a multi-layer ensemble detection model, and the output is the malicious behavior. It should also be noted that the key feature data needs to be preprocessed before being fed into the model. Data normalization is a fundamental data processing operation. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution for gradient search. After the model's calculation, the malicious behavior is output.

[0039] Step S204: Based on the transformer model, perform fine-grained classification of the above malicious behaviors to obtain the categories of the above malicious behaviors.

[0040] Specifically, the malicious behaviors are further classified in a fine-grained manner using the Transformer model to obtain their categories. The Transformer module is used to extract features from network traffic, device status, and operational behavior in the data corresponding to the malicious behaviors. These extracted features are then mapped through a multi-layer fully connected network, mapping different data into the same space. This achieves cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in power system networks, improving the security and stability of power system networks and providing a more comprehensive, efficient, and accurate solution for power system network security detection.

[0041] in addition, Figure 3 The process for detecting and identifying malicious behavior in power networks is demonstrated. First, features are extracted from data in network traffic. Then, the features are processed through methods such as feature reconstruction, feature normalization, and particle swarm optimization. Finally, a multi-layer ensemble ELM learning model is used to detect malicious behavior and determine whether it is malicious. If it is malicious, a transformer-based classification model is used for fine-grained classification.

[0042] In this embodiment, firstly, all network traffic data is acquired. This network traffic data consists of multiple power variable information and multiple category labels, with each power variable information corresponding to a category label. The power variable information includes at least power load data, power supply data, and current data, and the category labels indicate the category to which the corresponding power variable information belongs. Then, an improved adaptive elastic network method is used to reconstruct the features of the network traffic data and extract important feature data. This improved adaptive elastic network method introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the communication frequency, time period, source, and destination. Next, the important feature data is input into a multi-layer ensemble detection model, which outputs malicious behavior. This multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. Finally, the malicious behavior is classified in a fine-grained manner based on a transformer model to obtain the category of the malicious behavior. This application first receives raw network traffic data packets and extracts important network traffic features during the preprocessing stage, preparing corresponding normalized feature vectors. The detection and identification process is divided into two stages: first, constructing a multi-layer integrated detection model to determine whether it is malicious behavior; second, after detecting any malicious behavior, using Transform to extract features from network traffic, equipment status, and operational behavior collected in the power grid system. The extracted features are then mapped through a multi-layer fully connected network, mapping different data into the same space, achieving cross-sensor feature fusion and fine-grained identification and classification of malicious behavior in the power system network, thus determining the category of malicious behavior. This application solves the problem of low accuracy in malicious behavior detection in existing technologies due to limitations in data processing and feature extraction.

[0043] To enable those skilled in the art to better understand the technical solution of this application, the implementation process of the malicious behavior identification method for power networks of this application will be described in detail below with reference to specific embodiments.

[0044] To avoid overfitting of the multilayer ensemble detection model, in an optional implementation, step S202 includes:

[0045] Step S2021: Construct an adaptive elastic network regression model using the first formula, which is as follows: β0 represents the intercept coefficient, β jLet x represent the regression coefficient, i represent the index of the power variable information in the above network traffic data, j represent the index of the power data in the above power variable information, and x represent the regression coefficient. ij Let represent the j-th power data in the i-th power variable information, and p represent the total number of the power data corresponding to the power variable information;

[0046] Step S2022: Calculate the regression loss value using the above-mentioned adaptive elastic network regression model according to the second formula. The second formula is as follows: in, N represents the total number of the aforementioned power variable information items in the network traffic data, λ*1 is a fixed non-negative real number, |...| represents L1 norm elements, |...2 represents L2 norm elements, λ2 is an arbitrary non-negative constant, and γ is a positive real number. The regression loss value mentioned above, express L1 norm elements, Indicates the adjustment coefficient;

[0047] Step S2023: If the regression loss value is greater than the set loss threshold, the corresponding network traffic data is identified as the important feature data.

[0048] In the above embodiments, the significance of feature reconstruction lies in obtaining more flexible feature information from the original data, thereby improving data sensitivity and enhancing the analytical capabilities of model training and classification. Furthermore, in machine learning problems, training with too many features consumes significant computational overhead and is prone to overfitting, leading to a decline in model performance. To mitigate the impact of high-dimensional learning problems, an improved adaptive elastic network method is employed to select features. Let network traffic data be represented as (x... i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) represents electricity variable information, y i This represents the category label corresponding to the electricity variable information. At this point, the adaptive elastic network regression model can be constructed as follows: Regularization terms such as L1 and L2 regularization are introduced to prevent overfitting and improve the model's generalization ability. The L2 penalty is combined with a weighted L1 penalty, and the final regression loss is calculated using the penalized squared error loss. The regression loss value is then calculated using the second formula mentioned above. L1 and L2 penalties are commonly used in machine learning to help the model avoid overfitting. Based on the above calculations, relatively important features can be extracted from a large number of features, such as the frequency of communication, the time period of communication, and the source and destination of communication. Abnormal communication patterns may indicate malicious behavior. Further, these important feature data are combined into feature vectors and substituted into the training model to obtain more accurate classification results while maintaining low computational and operational costs.

[0049] To effectively improve the model's adaptability to noisy data, in an optional implementation, before step S203 above, the method further includes:

[0050] Step S301: The network traffic sample feature data is normalized using a data normalization method to obtain normalized feature data.

[0051] Step S302: Calculate the outlier score for each of the above-mentioned normalized feature data, where the outlier score represents the degree of abnormality of the above-mentioned normalized feature data relative to other above-mentioned normalized feature data.

[0052] Step S303: If the outlier score is greater than a set score threshold, the corresponding normalized feature data is determined as noise data.

[0053] Step S304: Based on the PSO-K mean clustering algorithm, these noisy data and normal data are trained to enhance the noisy data during the training process, forming the noise adaptive training set. The normal data are the normalized feature data corresponding to outlier scores that are less than or equal to the set score threshold.

[0054] In the above embodiments, the network traffic sample feature data needs to be preprocessed before being fed into the model for training. Data normalization is a fundamental operation in data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution for gradient search. Data normalization methods mainly include min-max and z-score normalization operations. Taking z-score normalization as an example, the z-score normalization operation is specifically described as follows: Where X represents the normalized feature data after z-score normalization, x represents the network traffic sample feature data, μ represents the mean of all network traffic sample feature data, and σ represents the standard deviation of all network traffic sample feature data. Noise in datasets has always been a significant challenge affecting classification or regression accuracy. Typically, there are two main types of noise in power data: category noise and attribute noise. Category noise is data with incorrect class labels. Attribute noise is data with incorrect attribute values. Considering that in reality, data points located in sparsely distributed regions of data have a lower probability of occurrence compared to data in densely distributed regions of the data space, these noisy data can be considered outliers. Therefore, a noise data processing method based on the PSO-Kmeans clustering algorithm (PSO) is used. This method first calculates the outlier score for each normalized feature data, representing the degree of anomalousness of each normalized feature data relative to other normalized feature data. By setting a threshold, i.e., the aforementioned set score threshold, outlier scores above this threshold are considered to be noise data. Based on a set score threshold, normalized feature data with outlier scores exceeding the threshold are identified as noise data. This noise data is then augmented in the training set to form a noise-adaptive training set. The noise-adaptive training set contains more noise than the original dataset. This enhances the model's adaptability to noisy data and alleviates overfitting to some extent. The PSOK-means algorithm execution flow is as follows: Figure 4 As shown.

[0055] To provide a model foundation for constructing a multi-layer integrated detection model, in an optional implementation, prior to step S204 above, the method further includes:

[0056] Step S401: Initialize model parameters. The model parameters include at least the number of input neurons, the number of hidden neurons, the number of output neurons, and the deviation of the hidden neurons in the single hidden layer feedforward neural network. The input neurons are the neurons in the input layer of the single hidden layer feedforward neural network, the hidden neurons are the neurons in the hidden layer of the single hidden layer feedforward neural network, and the output neurons are the neurons in the hidden layer of the single hidden layer feedforward neural network.

[0057] Step S402: Input all the sample data into multiple single-hidden-layer feedforward neural networks to obtain the classifier corresponding to each single-hidden-layer feedforward neural network. The sample data is any group of network traffic sample data in the sample dataset.

[0058] Step S403: Combine and optimize all the above classifiers to obtain a classifier sequence. The classifier sequence is obtained by sorting the performance of all the above classifiers from high to low.

[0059] Step S404: Select the output of the optimal classifier as the output of the multi-layer ensemble detection model. The optimal classifier is the first classifier in the classifier sequence. The output is either malicious behavior or non-malicious behavior.

[0060] In the above embodiment, the ELM model, as a single-hidden-layer feedforward neural network (SLFN) model, can randomly select input weights and latent biases without any adjustments. The parameters in the single-hidden-layer feedforward neural network are initialized as follows: let A be the number of input neurons, i.e., the number of important input features; let B be the number of hidden neurons; and let C be the number of output neurons, i.e., the number of output categories. Simultaneously, let the input weight matrix be K = [k1, k2, ..., k j ,...,k B ], where k j =[k j1 ,k j2 ,...,k jn Let b be a vector connecting A input neurons and the j-th hidden neuron, where b = [b1, b2, ..., bj]. j ,....,b B ] represents the bias vector of the hidden neuron, b j Let x be the bias of the j-th hidden neuron. Any input data in the model is x. i The output of ' is: h(x i ')=G(Kx i Let '+b), G(·) be the activation function, and let H be the output of the noise-adaptive training set data, then The column represents the distance from input x1' to x. N The output vector of the hidden neuron, where each row represents the output vector relative to the input x. j The output of the hidden layer. The output of the ELM model, that is, the final output of the single hidden layer feedforward neural network, is... Represents the classifier. The structure of a multi-level ensemble ELM model is as follows: Figure 5 As shown, multi-layer ensemble learning models typically contain multiple layers of ensemble learning models. Each layer of the ensemble model accepts the output of the previous layer as input and further processes and optimizes it. The final output is given by the top-level ensemble learning model. That is, the output of the optimal classifier is selected as the output of the aforementioned multi-layer ensemble detection model.

[0061] To improve the detection performance of the multi-layer ensemble learning model, in one optional implementation, step S403 includes:

[0062] Step S4031: Train all the above classifiers using an ensemble classifier to obtain the training results corresponding to each of the above classifiers.

[0063] Step S4032: Validate all the above training results and determine the performance ranking of each of the above classifiers. The performance ranking is used to represent the performance ranking of the above classifiers in different evaluation metrics.

[0064] Step S4033: Calculate the average ranking of each of the above classifiers based on their performance rankings.

[0065] Step S4034: Generate the classifier sequence based on the average ranking.

[0066] In the above embodiments, traditional voting or stacking methods have certain drawbacks when optimizing multiple classifiers output by the ELM model. For example, if the performance of one classifier is significantly lower than that of the others, it will have a significant impact on the overall model performance. Therefore, a multi-layer ensemble learning model is used to optimize the classifiers of the ELM model, thereby mitigating the adverse effects of "bad value" classifiers. The structure of the multi-layer ensemble ELM model is as follows: Figure 5 As shown, firstly, multiple classifiers are trained sequentially using an ensemble classifier. Simultaneously, the outputs of all ensemble classifiers in the first layer are validated on a validation set to compare their relative performance. Similarly, in the next layer of ensemble learning, the outputs of the previous layer's ensemble classifier are used to train the ensemble classifier again. After this process, all classifiers output from the next layer are ranked, from best to worst performance, to determine their performance metrics across different evaluation measures. Furthermore, based on the average ranking of each classifier across multiple evaluation measures, the ensemble learning model with the highest average ranking is tested on a test set to obtain the optimal classifier sequence. Therefore, the multi-layer ensemble learning model can eliminate classifiers with consistently poor performance, thereby improving the model training effect.

[0067] In order to accurately determine the type of malicious behavior, in one optional implementation, step S204 above includes:

[0068] Step S2041: Use the above transformer model to extract features from malicious data to obtain multimodal data;

[0069] Step S2042: Encode the multimodal data using the encoder in the transformer model to obtain a multimodal feature sequence, which is the output of the last encoder layer in the transformer model.

[0070] Step S2043: Perform a linear transformation on the above multimodal feature sequence to obtain a multimodal feature vector. The above multimodal feature vector is used to represent the probability that the above malicious behavior belongs to each of the above categories.

[0071] Step S2044: The category corresponding to the maximum value in the multimodal feature vector is determined as the category of the malicious behavior.

[0072] In the above embodiment, after detecting network behavior through a multi-layer ensemble learning model, fine-grained classification is performed on malicious behaviors. The model uses a Transformer model as the backbone network, and multiple Transformer models are used to extract features from the data of detected malicious behaviors. Then, knowledge enhancement is performed through a representation dictionary. The extracted features from various data types are merged as a multimodal embedding, i.e., the aforementioned multimodal data. The multimodal embedding is fed into the Transformer encoder for encoding to obtain the aforementioned multimodal feature sequence. The core of the Transformer encoder is the self-attention mechanism. First, three learnable linear transformation matrices W are used. q W k W v The multimodal input is mapped to corresponding vectors Q, K, and V. Then, attention weights between each feature in the multimodal feature sequence and other features are calculated using Q and K. Finally, the attention weights are compared with V. n Multiply them to obtain the output of the Transformer encoder. Among them, Q n =W q ·F n-1 K n =W k ·F n-1 V n =W v ·F n-1 These represent the matrices corresponding to the vectors Q, K, and V used by the nth Transformer encoder for self-attention operations, respectively. n-1 F represents the output of the (n-1)th layer of the Transformer model. n F represents the output of the nth layer of the Transformer model. 1 d represents the initial multimodal input. t It is the dimension of vector K, obtained by dividing by This ensures that the numerical range of the dot product is within a suitable range, avoiding problems such as excessively large or small gradients due to large dimensions, which helps improve the training efficiency and stability of the model. The fused multimodal feature sequence is the output F of the last Transformer encoder layer. N ={f1,f2,...,f nt+ni}, F N ∈R(nt+ni)×dt, where nt+ni is F N The dimension, f1 is F N The first column vector, f2 is F N The second column vector, F N The meanings of the remaining parameters are similar. Since each token in the multimodal embedding undergoes self-attention computation with other tokens, it can simultaneously capture the internal interactions within a modality and the mapping relationships between modalities, dynamically adjusting the weights of each modal feature and more rationally allocating attention weights. The fused multimodal feature vector cannot be directly used for malicious behavior classification; therefore, a simple attention network is used to obtain the final multimodal representation for classification, calculated sequentially according to the fourth, fifth, and sixth formulas. The fourth formula is a′ r =ReLU(f r W1+b1)W2+b2, where ReLU represents the activation function, f r F represents N ={f1,f2,...,f nt+ni Let W1 and W2 be the weight matrices of the linear transformation, b1 and b2 be the bias matrices of the linear transformation, and a′ be any number in the matrix. r This represents the output of each layer in the attention network. The attention network has multiple attention layers. The fifth formula is... Among them, a r Indicates a′ r The value calculated using the exp function is shown in the sixth formula. f represents the softmax classifier, Z ∈ R1×dt, and Z represents the feature vector. Next, this feature vector is input into a fully connected layer, and then the softmax classifier is used to construct the classification part. The calculation process is Z′=ReLU(ZW3+b3), where W3 and b3 are the weight matrix and bias matrix of the linear transformation, respectively, and Z′ represents the final output of the attention network. After the classification layer, the probability vector of the malicious behavior category is output, which is the aforementioned multimodal feature vector, calculated as follows: Let Z' represent the output vector of each column, and P represent the vector of probabilities of belonging to each malicious behavior. The malicious behavior category with the highest probability is the category of the malicious behavior mentioned above.

[0073] In order to classify malicious behavior in a finer-grained manner, in one optional implementation, step S2041 above includes:

[0074] Step S20411: The malicious data is transformed using the Embedding layer to obtain the corresponding high-dimensional data vector.

[0075] Step S20413: Input all the above high-dimensional data vectors into the above Encoder layer for encoding to obtain various text features;

[0076] Step S20413: Combine the various text features mentioned above to obtain the multimodal data.

[0077] In the above embodiments, the transformer model can be mainly divided into two parts: the Embedding layer and the Encoder layer. The Embedding layer converts words into word embeddings, which are then input into the Encoder layer for encoding to obtain text features. Knowledge enhancement is performed in the Embedding layer. The extracted text features are merged according to the third formula to obtain the aforementioned multimodal data, which serves as the multimodal embedding. The third formula is Multimodal Embedding = Concat(T, I), where T and I represent different text features, Concat() represents the merging function, and Multimodal Embedding is the aforementioned multimodal data.

[0078] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0079] This application also provides a malicious behavior identification device for power networks. It should be noted that the malicious behavior identification device for power networks in this application can be used to execute the malicious behavior identification method for power networks provided in this application. This device is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0080] The following describes the malicious behavior identification device for power networks provided in the embodiments of this application.

[0081] Figure 6 This is a structural block diagram of a malicious behavior identification device for a power network according to an embodiment of this application. Figure 6 As shown, the device includes:

[0082] The acquisition unit 10 is used to acquire all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information and the category labels correspond one-to-one. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0083] Specifically, data transmitted in power system networks exhibits diverse modalities, such as power load data, power supply data, power flow data, voltage data, and system log data. This data is collected and processed through communication networks and sensor devices to support the monitoring, control, and management of the power system. All network traffic data is acquired and represented in a specific format, such as (x... i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) represents electricity variable information, y i This is the category label corresponding to the electricity variable information.

[0084] The reconstruction unit 20 is used to reconstruct the network traffic data using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of the communication.

[0085] Specifically, the significance of feature reconstruction lies in obtaining more flexible feature information from the original data, thereby improving data sensitivity and enhancing the analytical capabilities of model training and classification. Furthermore, in machine learning problems, training with too many features consumes significant computational overhead and is prone to overfitting, leading to decreased model performance. To mitigate the impact of high-dimensional learning problems, an improved adaptive elastic network approach is employed to select features. This approach extracts relatively important features from a large dataset, such as communication frequency, communication timeframe, and the source and destination of the communication. Abnormal communication patterns may indicate malicious behavior.

[0086] The detection unit 30 is used to input the aforementioned important feature data into the multi-layer ensemble detection model and output malicious behavior. The aforementioned multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The aforementioned noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0087] Specifically, the aforementioned key feature data is input into a multi-layer ensemble detection model, and the output is the malicious behavior. It should also be noted that the key feature data needs to be preprocessed before being fed into the model. Data normalization is a fundamental data processing operation. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution for gradient search. After the model's calculation, the malicious behavior is output.

[0088] Classification unit 40 is used to perform fine-grained classification of the above malicious behaviors based on the transformer model to obtain the category of the above malicious behaviors.

[0089] Specifically, the malicious behaviors are further classified in a fine-grained manner using the Transformer model to obtain their categories. The Transformer module is used to extract features from network traffic, device status, and operational behavior in the data corresponding to the malicious behaviors. These extracted features are then mapped through a multi-layer fully connected network, mapping different data into the same space. This achieves cross-sensor feature fusion and fine-grained identification and classification of malicious behaviors in power system networks, improving the security and stability of power system networks and providing a more comprehensive, efficient, and accurate solution for power system network security detection.

[0090] in addition, Figure 3 The process for detecting and identifying malicious behavior in power networks is demonstrated. First, features are extracted from data in network traffic. Then, the features are processed through methods such as feature reconstruction, feature normalization, and particle swarm optimization. Finally, a multi-layer ensemble ELM learning model is used to detect malicious behavior and determine whether it is malicious. If it is malicious, a transformer-based classification model is used for fine-grained classification.

[0091] In this embodiment, the acquisition unit is used to acquire all network traffic data, which consists of multiple power variable information and multiple category labels. The power variable information and the category labels correspond one-to-one. The power variable information includes at least power load data, power supply data, and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs. The reconstruction unit is used to reconstruct the network traffic data using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the communication frequency, time period, source, and destination. The detection unit is used to input the important feature data into a multi-layer ensemble detection model and output malicious behavior. The multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. The classification unit is used to perform fine-grained classification of the malicious behavior based on a transformer model to obtain the category of the malicious behavior. This application first receives raw network traffic data packets and extracts important network traffic features during the preprocessing stage, preparing corresponding normalized feature vectors. The detection and identification process is divided into two stages: first, constructing a multi-layer integrated detection model to determine whether it is malicious behavior; second, after detecting any malicious behavior, using Transform to extract features from network traffic, equipment status, and operational behavior collected in the power grid system. The extracted features are then mapped through a multi-layer fully connected network, mapping different data into the same space, achieving cross-sensor feature fusion and fine-grained identification and classification of malicious behavior in the power system network, thus determining the category of malicious behavior. This application solves the problem of low accuracy in malicious behavior detection in existing technologies due to limitations in data processing and feature extraction.

[0092] To avoid overfitting of the multilayer ensemble detection model, in one optional implementation, the reconstruction unit includes:

[0093] The module constructs an adaptive elastic network regression model using the first formula, which is: β0 represents the intercept coefficient, β j Let x represent the regression coefficient, i represent the index of the power variable information in the above network traffic data, j represent the index of the power data in the above power variable information, and x represent the regression coefficient. ij Let represent the j-th power data in the i-th power variable information, and p represent the total number of the power data corresponding to the power variable information;

[0094] The first calculation module calculates the regression loss value using the aforementioned adaptive elastic network regression model according to the second formula, which is: in, N represents the total number of the aforementioned power variable information in the network traffic data, λ * 1 is a fixed non-negative real number, |...| represents L1 norm elements, |...2 represents L2 norm elements, λ2 is an arbitrary non-negative constant, and γ is a positive real number. The regression loss value mentioned above, express L1 norm elements, Indicates the adjustment coefficient;

[0095] The first determining module determines the network traffic data as the important feature data when the regression loss value is greater than the set loss threshold.

[0096] In the above embodiments, the significance of feature reconstruction lies in obtaining more flexible feature information from the original data, thereby improving data sensitivity and enhancing the analytical capabilities of model training and classification. Furthermore, in machine learning problems, training with too many features consumes significant computational overhead and is prone to overfitting, leading to a decline in model performance. To mitigate the impact of high-dimensional learning problems, an improved adaptive elastic network method is employed to select features. Let network traffic data be represented as (x... i ,y i ), i = 1, 2, ..., N, where x i =(x i1 ,x i2 ,...,x ip ) represents electricity variable information, y i This represents the category label corresponding to the electricity variable information. At this point, the adaptive elastic network regression model can be constructed as follows: Regularization terms such as L1 and L2 regularization are introduced to prevent overfitting and improve the model's generalization ability. The L2 penalty is combined with a weighted L1 penalty, and the final regression loss is calculated using the penalized squared error loss. The regression loss value is then calculated using the second formula mentioned above. L1 and L2 penalties are commonly used in machine learning to help the model avoid overfitting. Based on the above calculations, relatively important features can be extracted from a large number of features, such as the frequency of communication, the time period of communication, and the source and destination of communication. Abnormal communication patterns may indicate malicious behavior. Further, these important feature data are combined into feature vectors and substituted into the training model to obtain more accurate classification results while maintaining low computational and operational costs.

[0097] To effectively improve the model's adaptability to noisy data, in one optional embodiment, the device further includes:

[0098] The normalization unit is used to normalize the network traffic sample feature data by using a data normalization method before inputting the above important feature data into the multi-layer integrated detection model and outputting malicious behavior, so as to obtain normalized feature data.

[0099] The calculation unit calculates the outlier score for each of the above-mentioned normalized feature data, where the outlier score represents the degree of abnormality of the above-mentioned normalized feature data relative to other above-mentioned normalized feature data.

[0100] The unit determines the normalized feature data as noise data when the outlier score is greater than a set score threshold.

[0101] The training unit trains these noisy and normal data based on the PSO-K mean clustering algorithm to enhance the noisy data during the training process, forming the noise adaptive training set. The normal data are the normalized feature data corresponding to outlier scores that are less than or equal to the set score threshold.

[0102] In the above embodiments, the network traffic sample feature data needs to be preprocessed before being fed into the model for training. Data normalization is a fundamental operation in data processing. Its advantage is that it can improve the speed and accuracy of iteration, thereby obtaining the optimal solution for gradient search. Data normalization methods mainly include min-max and z-score normalization operations. Taking z-score normalization as an example, the z-score normalization operation is specifically described as follows: Where X represents the normalized feature data after z-score normalization, x represents the network traffic sample feature data, μ represents the mean of all network traffic sample feature data, and σ represents the standard deviation of all network traffic sample feature data. Noise in datasets has always been a significant challenge affecting classification or regression accuracy. Typically, there are two main types of noise in power data: category noise and attribute noise. Category noise is data with incorrect class labels. Attribute noise is data with incorrect attribute values. Considering that in reality, data points located in sparsely distributed regions of data have a lower probability of occurrence compared to data in densely distributed regions of the data space, these noisy data can be considered outliers. Therefore, a noise data processing method based on the PSO-Kmeans clustering algorithm (PSO) is used. This method first calculates the outlier score for each normalized feature data, representing the degree of anomalousness of each normalized feature data relative to other normalized feature data. By setting a threshold, i.e., the aforementioned set score threshold, outlier scores above this threshold are considered to be noise data. Based on a set score threshold, normalized feature data with outlier scores exceeding the threshold are identified as noise data. This noise data is then augmented in the training set to form a noise-adaptive training set. The noise-adaptive training set contains more noise than the original dataset. This enhances the model's adaptability to noisy data and alleviates overfitting to some extent. The PSOK-means algorithm execution flow is as follows: Figure 4 As shown.

[0103] To provide a model foundation for constructing a multi-layer integrated detection model, in one optional embodiment, the apparatus further includes:

[0104] An initialization unit is used to perform fine-grained classification of the aforementioned malicious behavior based on the transformer model. Before obtaining the category of the aforementioned malicious behavior, the model parameters are initialized. The aforementioned model parameters include at least the number of input neurons, the number of hidden neurons, the number of output neurons, and the deviation of the aforementioned hidden neurons in the aforementioned single hidden layer feedforward neural network. The aforementioned input neurons are neurons in the input layer of the aforementioned single hidden layer feedforward neural network, the aforementioned hidden neurons are neurons in the hidden layer of the aforementioned single hidden layer feedforward neural network, and the aforementioned output neurons are neurons in the hidden layer of the aforementioned single hidden layer feedforward neural network.

[0105] The input unit is used to input all the sample data into multiple single-hidden-layer feedforward neural networks to obtain the classifier corresponding to each single-hidden-layer feedforward neural network. The sample data is any group of network traffic sample data in the sample dataset.

[0106] The optimization unit is used to combine and optimize all the above classifiers to obtain a classifier sequence, which is a sequence obtained by sorting the performance of all the above classifiers from high to low.

[0107] The selection unit is used to select the output of the optimal classifier as the output of the multi-layer ensemble detection model. The optimal classifier is the first classifier in the classifier sequence, and the output is either malicious or non-malicious behavior.

[0108] In the above embodiment, the ELM model, as a single-hidden-layer feedforward neural network (SLFN) model, can randomly select input weights and latent biases without any adjustments. The parameters in the single-hidden-layer feedforward neural network are initialized as follows: let A be the number of input neurons, i.e., the number of important input features; let B be the number of hidden neurons; and let C be the number of output neurons, i.e., the number of output categories. Simultaneously, let the input weight matrix be K = [k1, k2, ..., k j ,...,k B ], where k j =[k j1 ,k j2 ,...,k jn Let b be a vector connecting A input neurons and the j-th hidden neuron, where b = [b1, b2, ..., bj]. j ,....,b B ] represents the bias vector of the hidden neuron, b j Let x be the bias of the j-th hidden neuron. Any input data in the model is x. i The output of ' is: h(x i ')=G(Kx i Let '+b), G(·) be the activation function, and let H be the output of the noise-adaptive training set data, then The column represents the distance from input x1' to x. N The output vector of the hidden neuron, where each row represents the output vector relative to the input x. j The output of the hidden layer. The output of the ELM model, that is, the final output of the single hidden layer feedforward neural network, is... Represents the classifier. The structure of a multi-level ensemble ELM model is as follows: Figure 5 As shown, multi-layer ensemble learning models typically contain multiple layers of ensemble learning models. Each layer of the ensemble model accepts the output of the previous layer as input and further processes and optimizes it. The final output is given by the top-level ensemble learning model. That is, the output of the optimal classifier is selected as the output of the aforementioned multi-layer ensemble detection model.

[0109] To improve the detection performance of multi-layer ensemble learning models, in one optional implementation, the optimization unit includes:

[0110] The training module trains all the above classifiers using an ensemble classifier to obtain the training results for each of the above classifiers.

[0111] The validation module validates all the above training results and determines the performance ranking of each of the above classifiers. The performance ranking is used to represent the performance ranking of the above classifiers in different evaluation metrics.

[0112] The second calculation module calculates the average ranking of each of the above classifiers based on their performance rankings.

[0113] The generation module generates the classifier sequence mentioned above based on the average ranking.

[0114] In the above embodiments, traditional voting or stacking methods have certain drawbacks when optimizing multiple classifiers output by the ELM model. For example, if the performance of one classifier is significantly lower than that of the others, it will have a significant impact on the overall model performance. Therefore, a multi-layer ensemble learning model is used to optimize the classifiers of the ELM model, thereby mitigating the adverse effects of "bad value" classifiers. The structure of the multi-layer ensemble ELM model is as follows: Figure 5 As shown, firstly, multiple classifiers are trained sequentially using an ensemble classifier. Simultaneously, the outputs of all ensemble classifiers in the first layer are validated on a validation set to compare their relative performance. Similarly, in the next layer of ensemble learning, the outputs of the previous layer's ensemble classifier are used to train the ensemble classifier again. After this process, all classifiers output from the next layer are ranked, from best to worst performance, to determine their performance metrics across different evaluation measures. Furthermore, based on the average ranking of each classifier across multiple evaluation measures, the ensemble learning model with the highest average ranking is tested on a test set to obtain the optimal classifier sequence. Therefore, the multi-layer ensemble learning model can eliminate classifiers with consistently poor performance, thereby improving the model training effect.

[0115] In order to accurately determine the category of malicious behavior, in one optional implementation, the classification unit includes:

[0116] The feature extraction module uses the aforementioned transformer model to extract features from malicious data, resulting in multimodal data.

[0117] The encoding module uses the encoder in the transformer model to encode the multimodal data to obtain a multimodal feature sequence, which is the output of the last encoder layer in the transformer model.

[0118] The linear transformation module performs a linear transformation on the above multimodal feature sequence to obtain a multimodal feature vector. The multimodal feature vector is used to represent the probability that the above malicious behavior belongs to each of the above categories.

[0119] The second determining module determines the category corresponding to the maximum value in the multimodal feature vector as the category of the malicious behavior.

[0120] In the above embodiment, after detecting network behavior through a multi-layer ensemble learning model, fine-grained classification is performed on malicious behaviors. The model uses a Transformer model as the backbone network, and multiple Transformer models are used to extract features from the data of detected malicious behaviors. Then, knowledge enhancement is performed through a representation dictionary. The extracted features from various data types are merged as a multimodal embedding, i.e., the aforementioned multimodal data. The multimodal embedding is fed into the Transformer encoder for encoding to obtain the aforementioned multimodal feature sequence. The core of the Transformer encoder is the self-attention mechanism. First, three learnable linear transformation matrices W are used. q W k W v The multimodal input is mapped to corresponding vectors Q, K, and V. Then, attention weights between each feature in the multimodal feature sequence and other features are calculated using Q and K. Finally, the attention weights are compared with V. n Multiply them to obtain the output of the Transformer encoder. Among them, Q n =W q ·F n-1 K n =W k ·F n-1 V n =W v ·F n-1 These represent the matrices corresponding to the vectors Q, K, and V used by the nth Transformer encoder for self-attention operations, respectively. n-1 F represents the output of the (n-1)th layer of the Transformer model. n F represents the output of the nth layer of the Transformer model. 1 d represents the initial multimodal input. t It is the dimension of vector K, obtained by dividing by This ensures that the numerical range of the dot product is within a suitable range, avoiding problems such as excessively large or small gradients due to large dimensions, which helps improve the training efficiency and stability of the model. The fused multimodal feature sequence is the output F of the last Transformer encoder layer. N ={f1,f2,...,f nt+ni}, F N ∈R(nt+ni)×dt, where nt+ni is F N The dimension, f1 is F N The first column vector, f2 is F N The second column vector, F N The meanings of the remaining parameters are similar. Since each token in the multimodal embedding undergoes self-attention computation with other tokens, it can simultaneously capture the internal interactions within a modality and the mapping relationships between modalities, dynamically adjusting the weights of each modal feature and more rationally allocating attention weights. The fused multimodal feature vector cannot be directly used for malicious behavior classification; therefore, a simple attention network is used to obtain the final multimodal representation for classification, calculated sequentially according to the fourth, fifth, and sixth formulas. The fourth formula is a′ r =ReLU(f r W1+b1)W2+b2, where ReLU represents the activation function, f r F represents N ={f1,f2,...,f nt+ni Let W1 and W2 be the weight matrices of the linear transformation, b1 and b2 be the bias matrices of the linear transformation, and a′ be any number in the matrix. r This represents the output of each layer in the attention network. The attention network has multiple attention layers. The fifth formula is... Among them, a r Indicates a′ r The value calculated using the exp function is shown in the sixth formula. f represents the softmax classifier, Z ∈ R1×dt, and Z represents the feature vector. Next, this feature vector is input into a fully connected layer, and then the softmax classifier is used to construct the classification part. The calculation process is Z′=ReLU(ZW3+b3), where W3 and b3 are the weight matrix and bias matrix of the linear transformation, respectively, and Z′ represents the final output of the attention network. After the classification layer, the probability vector of the malicious behavior category is output, which is the aforementioned multimodal feature vector, calculated as follows: Let Z' represent the output vector of each column, and P represent the vector of probabilities of belonging to each malicious behavior. The malicious behavior category with the highest probability is the category of the malicious behavior mentioned above.

[0121] To perform fine-grained classification of malicious behavior, in one optional implementation, the feature extraction module includes:

[0122] The transformation submodule uses the Embedding layer to transform the malicious data to obtain the corresponding high-dimensional data vector.

[0123] The encoding submodule inputs all the above high-dimensional data vectors into the Encoder layer for encoding to obtain various text features;

[0124] The merging submodule combines the various text features mentioned above to obtain the multimodal data.

[0125] In the above embodiments, the transformer model can be mainly divided into two parts: the Embedding layer and the Encoder layer. The Embedding layer converts words into word embeddings, which are then input into the Encoder layer for encoding to obtain text features. Knowledge enhancement is performed in the Embedding layer. The extracted text features are merged according to the third formula to obtain the aforementioned multimodal data, which serves as the multimodal embedding. The third formula is Multimodal Embedding = Concat(T, I), where T and I represent different text features, Concat() represents the merging function, and Multimodal Embedding is the aforementioned multimodal data.

[0126] The aforementioned malicious behavior detection device for the power network includes a processor and a memory. All of the aforementioned units are stored as program units in the memory, and the processor executes these program units to achieve the corresponding functions. All of the aforementioned modules reside in the same processor; alternatively, the modules may be located in different processors in any combination.

[0127] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can address the problem of low accuracy in network malicious behavior detection due to limitations in data processing and feature extraction in existing technologies.

[0128] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0129] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the malicious behavior identification method of the power network.

[0130] Specifically, methods for identifying malicious behavior in power grids include:

[0131] Step S201: Obtain all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0132] Step S202: The network traffic data is reconstructed using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication.

[0133] Step S203: Input the above important feature data into the multi-layer ensemble detection model and output the malicious behavior. The above multi-layer ensemble detection model is a convergent model obtained by inputting the noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0134] Step S204: Based on the transformer model, perform fine-grained classification of the above malicious behaviors to obtain the categories of the above malicious behaviors.

[0135] This invention provides a processor for running a program, wherein the program executes the malicious behavior identification method for the power network.

[0136] Specifically, methods for identifying malicious behavior in power grids include:

[0137] Step S201: Obtain all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0138] Step S202: The network traffic data is reconstructed using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication.

[0139] Step S203: Input the above important feature data into the multi-layer ensemble detection model and output the malicious behavior. The above multi-layer ensemble detection model is a convergent model obtained by inputting the noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0140] Step S204: Based on the transformer model, perform fine-grained classification of the above malicious behaviors to obtain the categories of the above malicious behaviors.

[0141] This invention provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs at least the following steps: (method claim steps, exclusive claim). The device described herein can be a server, PC, PAD, mobile phone, etc.

[0142] Step S201: Obtain all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0143] Step S202: The network traffic data is reconstructed using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication.

[0144] Step S203: Input the above important feature data into the multi-layer ensemble detection model and output the malicious behavior. The above multi-layer ensemble detection model is a convergent model obtained by inputting the noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0145] Step S204: Based on the transformer model, perform fine-grained classification of the above malicious behaviors to obtain the categories of the above malicious behaviors.

[0146] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps:

[0147] Step S201: Obtain all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs.

[0148] Step S202: The network traffic data is reconstructed using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication.

[0149] Step S203: Input the above important feature data into the multi-layer ensemble detection model and output the malicious behavior. The above multi-layer ensemble detection model is a convergent model obtained by inputting the noise adaptive training set into multiple single hidden layer feedforward neural networks for training. The above noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing.

[0150] Step S204: Based on the transformer model, perform fine-grained classification of the above malicious behaviors to obtain the categories of the above malicious behaviors.

[0151] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0152] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0153] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0154] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0155] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0156] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0157] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0158] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0159] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0160] As can be seen from the above description, the embodiments of this application achieve the following technical effects:

[0161] 1) The malicious behavior identification method for power networks in this application first receives raw network traffic data packets and extracts important network traffic features in the preprocessing stage, preparing corresponding normalized feature vectors. The detection and identification process is divided into two stages: constructing a multi-layer integrated detection model to determine whether it is a malicious behavior; after detecting any malicious behavior, using Transform to extract features from the network traffic, equipment status, and operation behavior collected in the power grid system, and performing feature mapping on the extracted features through a multi-layer fully connected network to map different data into the same space, realizing cross-sensor feature fusion and fine-grained identification and classification of malicious behavior in the power system network, and determining the category of malicious behavior; this application solves the problem of low accuracy in malicious behavior detection in the prior art due to limitations in data processing and feature extraction.

[0162] 2) The malicious behavior identification device for power networks in this application first receives raw network traffic data packets and extracts important network traffic features in the preprocessing stage, preparing corresponding normalized feature vectors. The detection and identification process is divided into two stages: first, constructing a multi-layer integrated detection model to determine whether it is malicious behavior; second, after detecting any malicious behavior, using Transform to extract features from the network traffic, equipment status, and operational behavior collected in the power grid system, and performing feature mapping on the extracted features through a multi-layer fully connected network, mapping different data into the same space, achieving cross-sensor feature fusion and fine-grained identification and classification of malicious behavior in the power system network, thus determining the category of malicious behavior. This application solves the problem in the prior art where the accuracy of malicious behavior detection is low due to limitations in data processing and feature extraction.

[0163] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for identifying malicious behavior in a power grid, characterized in that, include: All network traffic data is acquired. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data, and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs. An improved adaptive elastic network method is used to reconstruct the network traffic data and extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of communication. The important feature data is input into the multi-layer ensemble detection model, and the malicious behavior is output. The multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. The malicious behavior is classified in a fine-grained manner based on the transformer model to obtain the category of the malicious behavior; An improved adaptive resilient network method is used to reconstruct the features of the network traffic data and extract important feature data, including: constructing an adaptive resilient network regression model using a first formula, wherein the first formula is: , Represents the intercept coefficient. Represents the regression coefficient. i This indicates the number of the power variable information in the network traffic data. j This indicates the number of the power data in the power variable information. Indicates the first i The first of the aforementioned power variable information The aforementioned power data, This indicates the total number of power data items corresponding to the power variable information. The category labels are defined for the electricity variable information; the regression loss value is calculated using the adaptive elastic network regression model according to the second formula, where the second formula is... ,in, , N represents the total number of power variable information items in the network traffic data. 1 is a fixed non-negative real number. Represents L1 norm elements, Let λ be an L2 norm element, λ² be any nonnegative constant, and γ be a positive real number. The regression loss value is... express L1 norm elements, This represents the adjustment coefficient; when the regression loss value is greater than the set loss threshold, the corresponding network traffic data is determined as the important feature data.

2. The method according to claim 1, characterized in that, Before inputting the important feature data into the multi-layer ensemble detection model to output malicious behavior, the method further includes: The network traffic sample feature data is normalized using a data normalization method to obtain normalized feature data; For each of the normalized feature data, an outlier score is calculated, where the outlier score represents the degree of abnormality of the normalized feature data relative to the other normalized feature data. If the outlier score is greater than a set score threshold, the corresponding normalized feature data is identified as noise data. The PSO-K mean clustering algorithm is used to train these noisy and normal data to enhance the noisy data during the training process, forming the noise adaptive training set. The normal data are the normalized feature data corresponding to outlier scores that are less than or equal to the set score threshold.

3. The method according to claim 1, characterized in that, Before inputting the important feature data into the multi-layer ensemble detection model and outputting the malicious behavior, the method further includes: Initialize model parameters, which include at least the number of input neurons, the number of hidden neurons, the number of output neurons, and the bias of the hidden neurons in the single hidden layer feedforward neural network. The input neurons are the neurons in the input layer of the single hidden layer feedforward neural network, the hidden neurons are the neurons in the hidden layer of the single hidden layer feedforward neural network, and the output neurons are the neurons in the hidden layer of the single hidden layer feedforward neural network. All sample data are input into multiple single-hidden-layer feedforward neural networks to obtain classifiers corresponding to each single-hidden-layer feedforward neural network. The sample data is network traffic sample feature data of any group in the sample dataset. All the classifiers are combined and optimized to obtain a classifier sequence, which is a sequence obtained by sorting the performance of all the classifiers from high to low. The output of the optimal classifier is selected as the output of the multi-layer ensemble detection model. The optimal classifier is the first classifier in the classifier sequence, and the output is either malicious behavior or non-malicious behavior.

4. The method according to claim 3, characterized in that, By combining and optimizing all the classifiers, a classifier sequence is obtained, including: All the classifiers are trained using an ensemble classifier to obtain the training results for each classifier. Validate all the training results and determine the performance ranking of each classifier, which is used to represent the performance ranking of the classifier in different evaluation metrics; Calculate the average ranking of each classifier based on its performance ranking. The classifier sequence is generated based on the average ranking.

5. The method according to claim 1, characterized in that, The malicious behavior is classified in a fine-grained manner based on the transformer model to obtain the categories of the malicious behavior, including: The transformer model is used to extract features from malicious data to obtain multimodal data; The multimodal data is encoded using the encoder in the transformer model to obtain a multimodal feature sequence, which is the output of the last encoder layer in the transformer model. A linear transformation is performed on the multimodal feature sequence to obtain a multimodal feature vector, which is used to represent the probability that the malicious behavior belongs to each of the categories. The category corresponding to the maximum value in the multimodal feature vector is determined as the category of the malicious behavior.

6. The method according to claim 1, characterized in that, The transformer model includes an embedding layer and an encoder layer. It is used to extract features from malicious data, resulting in multimodal data, including: The malicious data is transformed using the Embedding layer to obtain a corresponding high-dimensional data vector; All the high-dimensional data vectors are input into the Encoder layer for encoding to obtain various text features; The multimodal data is obtained by merging the various text features.

7. A malicious behavior identification device for power networks, characterized in that, The device includes: The acquisition unit is used to acquire all network traffic data. The network traffic data consists of multiple power variable information and multiple category labels. The power variable information corresponds one-to-one with the category labels. The power variable information includes at least power load data, power supply data and current data. The category labels are used to indicate the category to which the corresponding power variable information belongs. The reconstruction unit is used to reconstruct the network traffic data using an improved adaptive elastic network method to extract important feature data. The improved adaptive elastic network method is a method that introduces a feature selection method into the elastic network method to extract highly important features from a large amount of data. The important feature data includes at least the frequency, time period, source and destination of the communication. The detection unit is used to input the important feature data into the multi-layer ensemble detection model and output malicious behavior. The multi-layer ensemble detection model is a convergent model obtained by inputting a noise adaptive training set into multiple single-hidden-layer feedforward neural networks for training. The noise adaptive training set is a dataset composed of multiple sets of network traffic sample feature data after noise processing. A classification unit is used to perform fine-grained classification of the malicious behavior based on the transformer model to obtain the category of the malicious behavior; The reconstruction unit includes: a construction module, used to construct an adaptive elastic network regression model using a first formula, wherein the first formula is: , Represents the intercept coefficient. Represents the regression coefficient. i This indicates the number of the power variable information in the network traffic data. j This indicates the number of the power data in the power variable information. Indicates the first i The first of the aforementioned power variable information The aforementioned power data, This indicates the total number of power data items corresponding to the power variable information. The category labels are defined for the electricity variable information; the first calculation module is used to calculate the regression loss value using the adaptive elastic network regression model according to the second formula, wherein the second formula is... ,in, , N represents the total number of power variable information items in the network traffic data. 1 is a fixed non-negative real number. Represents L1 norm elements, Let λ be an L2 norm element, λ² be any nonnegative constant, and γ be a positive real number. The regression loss value is... express L1 norm elements, The adjustment coefficient is represented by the first determining module, which is used to determine the corresponding network traffic data as the important feature data when the regression loss value is greater than the set loss threshold.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 6.

9. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images