Power network unknown attack automatic discovery method based on protocol deep analysis

Abstract

The invention provides a power network unknown attack automatic discovery method based on protocol deep analysis. The method comprises the following steps: step 1, establishing comprehensive monitoring index items from three levels of asset state, network flow and protocol instruction; 2, researching an automatic learning construction technology of a normal behavior reference model, establishing the normal reference model based on a plurality of RBM neural networks, researching normal behavior baselines such as a power business operation behavior reference, a same-type equipment reference and a specific communication line reference, and constructing a safety baseline index of the normal behavior model of the power network; an abnormal behavior discovery technology based on a normal reference model is researched on the basis; and step 3, carrying out verification of an abnormal behavior automatic discovery technology, and verifying the abnormal behavior automatic discovery technology by adopting the data based on the simulated network flow and the power network use and collection service. By applying the technical scheme, the unknown attack of the power network can be well and automatically discovered.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power networks, and in particular to an automatic discovery method for unknown attacks on electric power networks based on deep protocol analysis. Background Art

[0002] Due to defects in the security mechanisms of application software interface service providers, application software interface development teams, and application software interface itself, the development of application software interface provides an attack channel for attackers. It is extremely important to efficiently identify attacks based on application software interface vulnerabilities and locate application software interface vulnerabilities through anomaly detection methods for the life cycle management of application software interface assets. Existing technologies are still lacking in the ability to predict unknown network attacks. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide a method for automatic discovery of unknown attacks in power networks based on deep protocol analysis, which can well perform automatic discovery of unknown attacks in power networks.

[0004] To achieve the above object, the present invention adopts the following technical solution: a method for automatically discovering unknown attacks on power networks based on deep protocol analysis, comprising the following steps:

[0005] Step 1: Establish comprehensive monitoring indicators from three levels: asset status, network traffic, and protocol instructions;

[0006] Step 2: Study the automatic learning and construction technology of normal behavior benchmark models, establish normal benchmark models based on multiple RBM neural networks, study normal behavior baselines such as power business operation behavior benchmarks, benchmarks for the same type of equipment, and benchmarks for specific communication lines, and build security baseline indicators for normal behavior models of power networks; on this basis, study abnormal behavior discovery technology based on normal benchmark models;

[0007] Step 3: Conduct abnormal behavior automatic discovery technology verification by using simulated network traffic and power network usage business data to verify the abnormal behavior automatic discovery technology.

[0008] In a preferred embodiment, the indicators used for modeling normal network behavior in step 1 can be roughly divided into three categories: asset status indicators, network traffic indicators and protocol indicators.

[0009] In a preferred embodiment, the asset status indicators include operating status, configuration compliance, logs, and system abnormal behavior;

[0010] Operation status indicators include: CPU utilization, memory utilization, IO usage, network traffic, key processes, system service status, service port status, key file status, registry, startup items, kernel, hardware configuration, and operating system information;

[0011] Configuration compliance indicators include: account policy, log policy, authorization policy, IP communication policy, password policy, service configuration, kernel parameter configuration and vulnerability patch status;

[0012] Log indicators include: host logs, middleware logs, database logs, and various common application service logs;

[0013] System abnormal behavior indicators include: abnormal network access behavior, abnormal process operation behavior, abnormal API call behavior, abnormal registry operation behavior, abnormal file read and write behavior, and malicious files.

[0014] In a preferred embodiment, the network traffic indicators include:

[0015] Transport protocol type, discrete type, there are 3 types: TCP, UDP, ICMP;

[0016] The network service type of the target host, discrete type;

[0017] Specific protocol type, such as power consumption information collection protocol;

[0018] The network indicators of the terminal per unit time; the average length of the data packets sent and received by the terminal, the number of data packets sent by the terminal, the number of data packets received by the terminal, the number of service hosts connected to the terminal, and the number of ports used by the terminal;

[0019] Indicators of terminal connection to host: number of ports used by the host, frequency of ports used by the host.

[0020] In a preferred embodiment, the protocol pointer: the instruction pointer using the protocol includes Afn and Fn fields.

[0021] In a preferred embodiment, in step 2, the IoT architecture and common communication protocols are first analyzed, and the behavioral characteristics of the modeled business protocols are analyzed at the grammatical and semantic levels; then, the key fields of the protocol are taken as the objects of investigation, and a protocol behavior model is established according to the frequency and sequence of occurrence of the key fields of the protocol, and a behavior anomaly detection method based on the business protocol message is proposed;

[0022] The behavior anomaly detection method based on business protocol messages includes the steps of selecting protocol data packet features and establishing a sequence marking model. In the abnormal protocol behavior detection, after collecting the data packet observation sequence X from the network data flow in units of network connections, the normality y_i of each data packet is marked, and then the marking sequence Y is obtained, and the conditional random field is selected as the sequence marking model. After the conditional random field model is established, the principle of using it for real-time protocol anomaly detection is that for the observation sequence XN' of a certain protocol in each network connection, N represents the length of the network connection, and each observation value corresponds to a protocol data packet. According to the established CRF model, if a protocol anomaly occurs in this connection, a normal marking sequence YN=(1,1,…,1) is given, 1 represents a normal state, and the conditional probability p(y|x,θ) should be greater than a preset threshold pthr, and whether the protocol behavior is abnormal or not is determined according to the threshold.

[0023] In a preferred embodiment, step 2 includes the following steps:

[0024] Step 21: extract indicators according to the network characteristics of the power information system network, and complete the preprocessing of the extracted data. The preprocessing includes: data collection, indicator extraction, normalization, and then merging the indicators according to the amount of flow data in the time period Ta;

[0025] Step 22: The merged data is set as a training data set, and the time period is divided according to the common traffic transmission time of the network, and the data set is divided into various data clusters;

[0026] Step 23: Build a baseline model; the baseline model consists of K RBM networks, where K is initialized to 1.

[0027] In a preferred embodiment, step 23 includes:

[0028] 1) Randomly initialize an RBM network. The network parameters of the RBM network can be set to random numbers first. Then, the normalized index data is input into the RBM model. The network does not record the output of the hidden layer. The model training is completed by minimizing the error between the model output and the original input. The output process of the model is that the original index data is input into the visible layer, and then the hidden layer data is reversely trained to the output of the visible layer through hidden layer training. The RBM model obtained by the first data cluster training is set as the initial benchmark model.

[0029] Input x i With the output y i The square root error is expressed as follows:

[0030]

[0031] 2) Take a data cluster, input the data cluster into each RBM model, test all RBM benchmark models in the benchmark model set, calculate the reconstructed output of the data cluster in the benchmark model, and calculate the square root error between the output data and the original data;

[0032] 3) Compare all square root errors;

[0033] If all square root errors ρ exceed the set threshold, it means that the data does not match any existing RBM network patterns, so the data belongs to a new pattern type. In this case, a new RBM network is created, randomly initialized, and the data cluster is input into the new RBM network for training, and the network parameters are adjusted. The RBM network is added to the benchmark model.

[0034] If some square root errors are within the threshold range, select the model set with the smallest square root error ρ, add the original data of the data cluster into the data set of the corresponding benchmark model; if there are too many data in the data set, randomly discard some redundant data according to the set data set amount, train a new data set and update the corresponding benchmark model parameters;

[0035] Minimum square root error ρ = min{pj}, j is the jth model

[0036] 4) Return to step 2) until all data training is completed;

[0037] 5) According to the number of data clusters in the RBM model after clustering, the abnormality of each data cluster is set. The more data clusters there are in the RBM model, the more the model conforms to the network segment transmission law, and the lower the abnormality of the corresponding data cluster;

[0038] Abnormality Where n is the data cluster data in the RBM model, and N is the number of all data clusters;

[0039] 6) Set an abnormality detection threshold, aggregate the RBM models that meet the abnormality threshold, and aggregate them into a multi-RBM model set. The model set corresponds to multiple RBM models. The number of RBM models is K. Each RBM model corresponds to its own parameters and data cluster. The multi-RBM model set is the normal benchmark model of the network.

[0040] In a preferred embodiment, starting from the network flow attributes, the composition of the network flow order is designed; manifold learning is studied and a network flow order characterization scheme is proposed based on manifold learning; the multi-layer perceptron algorithm is studied and a network flow order classification method based on the multi-layer perceptron is proposed.

[0041] Compared with the prior art, the present invention has the following beneficial effects: it can automatically discover unknown attacks on the power network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of an automatic discovery technology for unknown attacks on a power network based on deep protocol analysis according to a preferred embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of monitoring and collecting asset status indicators according to a preferred embodiment of the present invention;

[0044] Figure 3 A schematic diagram of network indicator monitoring and collection according to a preferred embodiment of the present invention;

[0045] Figure 4 A schematic diagram of a network order flow detection process according to a preferred embodiment of the present invention;

[0046] Figure 5 This is a schematic diagram of parallel parsing of power Internet of Things service protocol messages in a preferred embodiment of the present invention;

[0047] Figure 6 A schematic diagram of a protocol behavior model of a preferred embodiment of the present invention;

[0048] Figure 7 A flowchart of protocol behavior anomaly detection in a preferred embodiment of the present invention;

[0049] Figure 8 Automatically construct a flow chart for a normal baseline model of a preferred embodiment of the present invention;

[0050] Fig. 9 A schematic diagram of spatial mapping of a preferred embodiment of the present invention;

[0051] Fig.10 A schematic diagram of a network flow order characterization process based on manifold learning according to a preferred embodiment of the present invention;

[0052] Fig.11 A schematic diagram of a multi-layer perceptron network structure according to a preferred embodiment of the present invention;

[0053] Fig.12 A schematic diagram of a network order flow detection process according to a preferred embodiment of the present invention;

[0054] Fig.13 A schematic diagram of a protocol behavior model of a preferred embodiment of the present invention;

[0055] Fig.14 It is a schematic diagram of an abnormal analysis model based on a device portrait matrix according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0056] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0057] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0058] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0059] Automatic discovery technology of unknown attacks on power networks based on deep protocol analysis, reference Figure 1-14 First, comprehensive monitoring indicators are established from three levels: asset status, network traffic, and protocol instructions. Secondly, the automatic learning and construction technology of normal behavior benchmark models is studied. A normal benchmark model is established based on multiple RBM neural networks. Normal behavior baselines such as power business operation behavior benchmarks, benchmarks for the same type of equipment, and benchmarks for specific communication lines are studied to construct safety baseline indicators for normal behavior models of power networks. On this basis, the abnormal behavior discovery technology based on the normal baseline model is studied. Finally, the automatic abnormal behavior discovery technology is verified by using simulated network traffic and power network-based business data to verify the automatic abnormal behavior discovery technology. Research technical routes such as Figure 1 .

[0060] 1. Establish comprehensive monitoring indicators

[0061] The indicators that can be used to model normal network behavior can be roughly divided into three categories: asset status, network traffic, and protocol indicators:

[0062] 1) Asset status indicators

[0063] The indicators of asset equipment mainly include four aspects: operating status, configuration compliance, logs and system abnormal behavior.

[0064] ① Operation status indicators include: CPU utilization, memory utilization, IO usage, network traffic, key processes, system service status, service port status, key file status, registry, startup items, kernel, hardware configuration, operating system information, etc.

[0065] ②Configuration compliance indicators include: account policy, log policy, authorization policy, IP communication policy, password policy, service configuration, kernel parameter configuration and vulnerability patch status, etc.

[0066] ③Log indicators include: host logs, middleware logs, database logs, various common application service logs, etc.

[0067] ④ System abnormal behavior indicators include: abnormal network access behavior, abnormal process operation behavior, abnormal API call behavior, abnormal registry operation behavior, abnormal file read and write behavior, malicious files, etc.

[0068] 2) Network traffic indicators

[0069] ①Transmission protocol type, discrete type, there are 3 types: TCP, UDP, ICMP.

[0070] ② The network service type of the target host, discrete types, a total of 70 types, such as: bgp, domain, http, ssh, ntp, smtp, etc.

[0071] ③Specific agreement types, such as electricity consumption information collection agreement (hereinafter referred to as "electricity consumption information collection"), etc.

[0072] ④Network indicators of the terminal per unit time

[0073] a) Average length of data packets sent and received by the terminal

[0074] b) The number of data packets sent by the terminal

[0075] c) The number of data packets received by the terminal

[0076] d) Number of service hosts connected to the terminal

[0077] e) Number of ports used by the terminal

[0078] ⑤Indicator of terminal connection to host (may be located in data acquisition machine)

[0079] a) The number of ports used by the host

[0080] b) Frequency of ports used by the host

[0081] 3) Protocol instruction indicators

[0082] The protocol instruction index has different indicators for different protocols. Generally speaking, the protocol instructions are divided into different types according to the different data types and commands transmitted by the power grid industrial control protocol, and specific types are used as the protocol instruction indicators. The following uses the sampling protocol as an example to introduce the protocol instruction indicators.

[0083] The message type of the adoption protocol has two fields, Afn and Fn. Different values ​​mean different data contents, some are commands, some are data, and the types are different. Therefore, the instruction indicator of the adoption protocol must include these two fields.

[0084] The existing protocol parsing can also parse more fields and parse out data that does not comply with field regulations. This type of error data packet is also an indicator of the instruction type.

[0085] The data collection of asset status related indicators mainly relies on the terminal probe method. The main workflow diagram is as follows: Figure 2 .

[0086] First, according to the system type, various terminal collection probes are deployed to each terminal system to run, collect operation status indicator data, configuration compliance indicator data, various log data, and detect and identify abnormal terminal behavior data through scanning and detection, and upload various data information to a unified data analysis platform for storage. In addition, all corresponding asset data needs to be imported into the data analysis platform and stored uniformly by the platform.

[0087] The collection of network traffic related indicators mainly relies on the deployed network probes. By deploying network probes in different areas, network traffic related data is collected and reported to the data analysis platform. The main process is as follows: Figure 3 .

[0088] Network traffic is connected to the network-end probe through traffic mirroring or splitting. After the probe captures the data packet, it reassembles the packet and restores the protocol, and attempts to identify the network service. In this process, the basic information such as the five-tuple (source IP, destination IP, source port, destination port, protocol type), traffic size, load content, etc. is recorded for statistical analysis, and the information is uploaded to the data analysis platform for storage and analysis.

[0089] 2. High-speed parallel parsing technology for power-specific protocols

[0090] Firstly, the IoT architecture and common communication protocols are analyzed, and the behavioral characteristics of the modeled business protocols are analyzed at the syntax and semantic levels. Then, the key fields of the protocol are taken as the object of investigation, and the protocol behavior model is established according to the frequency and sequence of the key fields of the protocol. A behavior anomaly detection method based on business protocol messages is proposed.

[0091] (1) IoT architecture and communication protocols

[0092] 1) Research on IoT architecture

[0093] From the development perspective, wireless access is the core technology of the IoT device side, and identity device management and message push technology are the core technologies of the IoT cloud side. From the perspective of scene experience, in addition to the former, the front-end development technology of mobile phones is also required. The IP interconnection architecture is the de facto standard of the IoT. Let’s further abstract the composition of the IoT based on the IP architecture, such as Figure 4As shown (ignoring basic technologies such as the internet and routing).

[0094] The security goals of the Internet of Things are basically the same as those of other networks, which mainly include confidentiality, integrity, availability, non-repudiation and data freshness. In addition, the security goals of the Internet of Things also include privacy, anonymity and trust.

[0095] 2) Research on IoT-related communication protocols

[0096] In order to better complete the parallel parsing of business protocol messages, a protocol behavior model is constructed. First, the Internet of Things related communication protocols are studied.

[0097] ① Adaptive layer protocol - 6LoWPAN

[0098] The current Internet protocol is based on IP technology. The Internet of Things is an extension of the Internet. Applying IP technology to the Internet of Things can bring many benefits, such as easy interoperability with other IP networks, use of IP network's mature security mechanisms and load balancing, etc.

[0099] ②MTQQ

[0100] MQTT is a lightweight protocol developed by IBM for the Internet of Things, built on top of the TCP / IP layer protocol. It is an important part of the Internet of Things and may become the de facto standard for the Internet of Things. It has QoS, can buffer messages, and ensure that terminal devices receive messages through a retransmission mechanism; its message format is extremely simplified, with the shortest being two bytes; it provides subscription and publishing modes to push messages efficiently.

[0101] ③CoAP

[0102] CoAP is an IoT application layer protocol based on the REST architecture, with a minimum packet length of only 4 bytes. The biggest difference between the CoAP protocol and the HTTP protocol is that the former is based on the UDP transport protocol, while the latter is based on the TCP transport protocol. The main reason is that the TCP protocol is very complex (including flow control and retransmission mechanisms) and is not easy to run in resource-constrained embedded devices, while the UDP protocol is relatively simple and supports multicast. The CoAP protocol provides a request / response communication model. The CoAP client node sends request information to the server, and the server responds. Since CoAP uses the UDP transport protocol, CoAP communication does not require a connection to be established in advance. The CoAP protocol also provides a lightweight reliable mechanism. The CoAP protocol is divided into two layers: the request / response layer and the session layer. The session layer is only responsible for controlling end-to-end message interaction, and the request / response layer is responsible for transmitting requests and responses for resource operations.

[0103] (2) Parallel parsing and syntax anomaly detection of service protocol messages

[0104] Terminal layer business security anomaly analysis based on deep protocol analysis mainly targets plaintext traffic and determines whether the message content and protocol operation are abnormal from the two levels of syntax and semantics. At the syntax level, a protocol parallel parsing technology is proposed to quickly extract the key protocol fields and their corresponding field values ​​from the message, and then compare them with the set whitelist. Those not in the whitelist are business security anomalies. And deep learning model for message protocol data anomaly detection. At the semantic level, the frequency and sequence of occurrence of protocol keywords are used to establish a behavior model of the protocol. Based on this model, business operation anomalies are detected.

[0105] For the power Internet of Things service protocol, its message contains multiple key fields. The main principle of parallel parsing is to parse the key fields 1, 2, and 3 in the message at the same time, rather than sequentially, such as parsing field 1 first, then fields 2 and 3. Through parallel processing, the message parsing speed can be significantly improved, thereby speeding up the business protocol anomaly detection based on whitelist matching. The principle diagram of parallel parsing is shown in the figure below. Figure 5 shown.

[0106] In order to realize the anomaly detection at the semantic level of the full-service power Internet of Things service protocol, a practical protocol behavior modeling method is proposed. The key fields of the protocol are taken as the investigation object, and the protocol behavior model is established according to the frequency and sequence of the key fields of the protocol. The specific steps are as follows: statistically calculate the frequency of occurrence of protocol keywords, statistically calculate the frequency of combination of protocol keywords, and statistically calculate the time interval between two keywords that appear before and after;

[0107] 4) Build a protocol behavior model to detect abnormal protocol messages

[0108] Based on the statistical results of steps 1)-3), a behavior model of the protocol can be established and abnormal protocol message detection can be performed:

[0109] 1) Construct a protocol behavior model, such as Figure 6 As shown in the figure, the node attributes include the key field name and the frequency of occurrence, and the edge attributes include the time interval and the frequency of occurrence of the keyword combination;

[0110] 2) Traverse the protocol behavior model diagram, and if the frequency of a key field exceeds the set threshold, it is judged to be abnormal;

[0111] 3) If the frequency of the keyword combination exceeds the set threshold, it is judged as abnormal;

[0112] 4) If the time interval between the previous and next keywords deviates from the normal distribution, it is judged to be abnormal.

[0113] After an in-depth analysis of the protocol messages, a behavior anomaly detection method based on business protocol messages is proposed.

[0114] 1) Protocol data packet feature selection

[0115] The protocol behavior process is reflected in the interaction between a series of protocol keywords. Protocol keywords refer to words that can reflect the user's behavior when using the application layer protocol, and can be used to distinguish the message types in the protocol. For example, the keywords of the HTTP protocol are composed of method words such as OPTION, GET, HEAD, POST, and response codes such as 100, 202, 301, and 404. Therefore, it is proposed to use the protocol keyword sequence as an observation sequence to characterize the protocol behavior.

[0116] 2) Model building

[0117] In the detection of abnormal protocol behavior, after collecting the data packet observation sequence X from the network data flow in units of network connections, the normality y_i of each data packet is marked to obtain the labeled sequence Y. This is a process of obtaining a labeled sequence from an observation sequence. Conditional random fields are selected as the sequence labeling model.

[0118] After the conditional random field model is established, the principle of using it for real-time protocol anomaly detection is that for each observation sequence XN' of a certain protocol in each network connection, N represents the length of the network connection, and each observation value corresponds to a protocol data packet. According to the established CRF model, if a protocol anomaly occurs in this connection, a normal tag sequence YN=(1,1,…,1) is given, 1 represents the normal state, and the conditional probability p(y|x,θ) should be greater than the preset threshold pthr.

[0119] The value determines whether the protocol behavior is abnormal or not. The specific abnormal protocol behavior process is as follows Figure 7 shown.

[0120] 3. Normal Behavior Benchmark Model Self-Learning Construction Technology

[0121] Since the power information network may encounter various uncertain situations in actual operation, the operating status may be affected by various internal and external situations, which may lead to many different consequences. In the power information system, abnormal situations are more manifested in power terminals, network data transmission, protocol instructions, etc. Through the information provided by power information network equipment, power measurement systems, data acquisition devices and other equipment, the status characteristics and trend indicators that reflect the operating status of power equipment are set, and the normal behavior benchmark model under various circumstances is constructed, so as to grasp the operating status of the power information network in real time and better deal with possible abnormal phenomena and high-risk events.

[0122] For the network traffic data of the power information network, a normal data transmission baseline is constructed. First, the historical transmission message data is preprocessed to obtain the index component. The index component can be divided into event clusters of each fixed time period according to the time period, and then the network parameters are obtained by entering the RBM network through an initially set time period. The parameter model is the initial benchmark model, and then clustering is performed. The clustering is completed by whether the new time period conforms to the original benchmark model. If it does not conform, it is set as a new benchmark model. If it conforms, the existing benchmark model is added and the parameters are updated. The setting of the benchmark model is completed through continuous updating and iteration, and then the benchmark model is accurately defined by setting the anomaly degree and the anomaly degree threshold, and the abnormal traffic is detected in real time through the anomaly degree detection error.

[0123] The construction of the normal behavior baseline includes a behavior model self-learning construction technology, which analyzes the big data of the power information system (historical business data transmission information) and constructs a set of data transmission models under various scenarios to represent the normal baseline. It has a relatively large advantage in real-time processing of such big data and multi-situation power information network data. In order to prevent the situation where a single RBM has limited memory capacity and memory interference of different modes, we designed a baseline model construction method based on multiple RBM networks. This method uses multiple RBM networks to complete the characterization of data transmission modes, and the method of constructing a baseline model based on multiple RBM networks is mainly completed through the following modeling methods:

[0124] The first step is to extract indicators according to the network characteristics of the power information system network. The extracted data completes the preprocessing stage, which includes: data collection, indicator extraction, normalization, and then merge the indicators according to the amount of flow data in the time period Ta.

[0125] The second step is to set the merged data as the training data set, and divide the time period according to the common network traffic transmission time (a fixed time period Tb), and divide the data set into various data clusters.

[0126] Step 3: Build a baseline model. The baseline model consists of K RBM networks, where K is initialized to 1.

[0127] 1) Randomly initialize an RBM network. The network parameters of the RBM network can be set to random numbers first. Then, the normalized indicator data (all data within the set time period Tb) is input into the RBM model. The network does not record the output of the hidden layer. The model training is completed by minimizing the error between the model output and the original input. The output process of the model is that the original indicator data is input into the visible layer, trained through the hidden layer, and then the hidden layer data is reversed to the output of the visible layer. The RBM model obtained by the first data cluster training is set as the initial benchmark model.

[0128] The square root error between input xi and output yi (i is the i-th visible layer node) is expressed as follows:

[0129]

[0130] 2) Take a data cluster, input the data cluster into each RBM model, test all RBM benchmark models in the benchmark model set, calculate the reconstructed output of the data cluster in the benchmark model, and calculate the square root error between the output data and the original data.

[0131] 3) Compare all square root errors.

[0132] If all square root errors ρ exceed the set threshold, it means that the data does not match any existing RBM network model, so the data belongs to a new model type, and step ① is repeated: a new RBM network is created, randomly initialized, the data cluster is input into the new RBM network for training, and the network parameters are adjusted. The RBM network is added to the benchmark model.

[0133] If some square root errors are within the threshold range, the model set with the smallest square root error ρ is selected, and the original data of the data cluster is added to the data set of the corresponding benchmark model. If there is too much data in the data set, some redundant data is randomly discarded according to the set data set data volume, and a new data set is trained and the corresponding benchmark model parameters are updated.

[0134] Minimum square root error ρ = min{pj}, j is the jth model

[0135] 4) Return to step 2) until all data are trained.

[0136] 5) The abnormality of each data cluster is set according to the number of data clusters in the RBM model after clustering. The more data clusters there are in the RBM model, the more the model conforms to the network segment transmission law, and the corresponding data cluster abnormality is lower.

[0137] Abnormality Where n is the data cluster number in the RBM model, and N is the number of all data clusters.

[0138] 6) Set an abnormality detection threshold, aggregate the RBM models that meet the abnormality threshold, and aggregate them into a multi-RBM model set. The model set corresponds to multiple RBM models. The number of RBM models is K. Each RBM model corresponds to its own parameters and data cluster. The multi-RBM model set is the normal benchmark model of the network.

[0139] Some concepts in the method are explained as follows:

[0140] The first step of normalization in data preprocessing is to limit the data to [0, 1] by changing the maximum and minimum values, which speeds up the convergence of the algorithm and facilitates the setting of the input data of the RBM network.

[0141] The index extraction described in the first step is: according to the power network flow data transmission protocol, extract the time, quantity, type and other indicators of the message transmission for index selection, remove the redundant indicators in the data set, and obtain the extracted message indicators.

[0142] The data cluster described in the third step is: the collection of normalized indicator data within the specified time period Tb. The reconstructed data is the data output in the visible layer after the indicator data is trained by the RBM network. The more similar the reconstructed data is to the original data, the more the original data structure conforms to the RBM network. The RBM network and algorithm parameters include but are not limited to the learning rate α, the number of iterations n, the number of nodes in the visible layer and the hidden layer, the root mean square error threshold e, the merged time period Ta, the clustering time period Tb of the time cluster, etc., wherein: the learning rate α refers to the range of each parameter change after the RBM model receives feedback. The larger the learning rate, the faster the convergence speed, but it is difficult to converge to the accurate value; the number of iterations n refers to the number of times the RBM network is trained to converge. In order to prevent the RBM model from overfitting, a certain error is allowed; the number of nodes in the visible layer and the hidden layer is the setting of the RBM network. The number of nodes in the visible layer is determined by the index of the input data, and the number of nodes in the hidden layer is related to the dimension after dimensionality reduction and the accuracy required for convergence. Generally, experiments are required to obtain reasonable results.

[0143] Definition of some set values ​​in the method; the root mean square error threshold e refers to the similarity between the input data and the existing RBM. The larger the root mean square error, the smaller the similarity, the fewer models after clustering, but the larger the error; the merged time period Ta refers to the merged number of single data within the time after the information network indicators are extracted, which is used to characterize the short-term traffic transmission characteristics of the network segment. The clustering time period Tb of the time cluster refers to the time period within each RBM model, in which there are multiple merged time period data, indicating the traffic transmission mode of the network segment input and output in a period of time.

[0144] The abnormality degree described in the third step is the percentage of abnormal data in the model, which is determined by the number of data clusters in the RBM model after clustering. The more data clusters there are in the RBM model, the lower the abnormality degree of the corresponding data clusters. At the same time, the abnormality threshold described in the third step is the error between the RBM model and the normal benchmark model. The smaller the threshold setting, the smaller the error, and the RBM is the normal benchmark model.

[0145] 4. Network flow order classification method based on multi-layer perceptron

[0146] Starting from the network flow attributes, the composition of network flow order is designed; manifold learning is studied and a network flow order characterization scheme based on manifold learning is proposed; the multi-layer perceptron algorithm is studied and a network flow order classification method based on multi-layer perceptron is proposed.

[0147] (1) Network flow attributes

[0148] The network traffic attributes to be extracted include: TCP connection basic features, TCP connection content features, time-based network traffic statistics features, and host-based network traffic statistics features. Among them, TCP connection basic features include some basic properties of the connection; TCP connection content features refer to content features that can reflect intrusion behavior; time-based network traffic statistics features count the relationship between the current connection record and the connection records in the previous period of time; host-based network traffic statistics features count the information of the 100 connection records before the current connection that have the same target host as the current connection.

[0149] The goal of preprocessing the basic attributes of network traffic is to make the length of the flow order vector consistent for different traffic flows, and to save as much attribute information of the network traffic itself as possible. A common method of preprocessing is to take the first n messages of all network traffic, and then save the basic attributes corresponding to these n messages, such as message length, message time slot, etc. The drawback of this method is that for a long connection flow, a large amount of attribute information will be discarded. The traffic instance is regarded as two time series: a sequence of incoming packets of different sizes with timestamps and a sequence of similar outgoing packets. For these two time series, the number of bytes transmitted per time unit in a fixed time period is calculated. Therefore, each data stream is converted into two distributions of the same size.

[0150] (2) Manifold Learning

[0151] The viewpoint of manifold learning is that the data we can observe is actually mapped from a low-dimensional manifold to a high-dimensional space. Due to the limitation of the internal characteristics of the data, some high-dimensional data will produce dimensional redundancy. In fact, this data can be uniquely represented as long as it is relatively low-dimensional. Manifold learning mainly includes the following concepts:

[0152] 1) Manifold

[0153] Intuitively speaking, a manifold is like a dd-dimensional space, which is the result of being distorted in an mm-dimensional space (m>d)(m>d). The manifold is a space that is locally homeomorphic to the Euclidean space, that is, it has the properties of the Euclidean space locally, and can be used to calculate distances using the Euclidean distance, which is a great inspiration for dimensionality reduction. If a low-dimensional manifold is embedded in a high-dimensional space, the distribution of samples in the high-dimensional space is complex, but it still has the properties of the Euclidean space locally. Therefore, a dimensionality reduction mapping relationship can be established locally, and then the local mapping relationship can be generalized to the global. Moreover, when the data is reduced to two and three dimensions, it can be visualized, so manifold learning can also be used for visualization.

[0154] 2) Equal-metric mapping

[0155] First, let's introduce the MDS algorithm. The core idea of ​​the MDS algorithm is to find a low-dimensional space so that the distance between samples in high-dimensional space and low-dimensional space is basically the same. Therefore, the MDS algorithm uses the similarity between samples to keep the output results after dimensionality reduction consistent with those before dimensionality reduction. However, directly calculating the straight-line distance between samples in high-dimensional space is very misleading. The Isomap algorithm is a variant of the MDS algorithm. Its idea is the same as that of MDS, except that it uses geodesic distance when calculating the distance in high-dimensional space instead of the Euclidean distance between two points, which cannot truly express the distance between two points.

[0156] The Isomap algorithm is global, and it seeks to find the global optimal solution for all samples. When the amount of data is large or the sample dimension is high, the amount of calculation is very large. Therefore, the more commonly used algorithm is Local Linear Embedding (LLE), which abandons the global optimal dimensionality reduction of all samples and only reduces the dimensionality by ensuring the local optimality.

[0157] 3) Local Linear Embedding

[0158] The idea of ​​local linear embedding is to try to maintain the relationship between samples in the domain, such as Fig. 9 As shown in the figure. After the samples are mapped from high-dimensional space to low-dimensional space, the linear relationship between samples in various fields remains unchanged. The LLE algorithm can learn locally linear low-dimensional manifolds of any dimension, and can also process nonlinear data and perform nonlinear dimensionality reduction. Its algorithm can be reduced to sparse matrix eigendecomposition, which has low computational complexity and is easy to implement.

[0159] (3) Characterization of network flow order based on manifold learning

[0160] Based on manifold learning, the network flow order is characterized. The overall implementation process is as follows: Fig.10 shown.

[0161] In order to describe the order of network flow, we first need to select the LLE algorithm according to the network flow data attributes to perform feature learning and dimensionality reduction on the original data. This mainly involves the following steps:

[0162] 1) Data vector processing

[0163] The original traffic data contains some character discrete data. First, these character discrete data need to be processed and converted into N-dimensional 0, 1 vectors (N is the number of types of each character discrete data). In order to facilitate subsequent processing, the original traffic data also needs to be normalized. The processed data forms a fusion vector.

[0164] 2) Perform Fourier transform on the data

[0165] Perform discrete Fourier transform on the fusion vector extracted in 1) to extract the frequency domain data vector of the original data.

[0166] 3) LLE manifold data analysis

[0167] The Fourier transformed data is used as input, and the k nearest neighbor points of each data are first calculated (k is a pre-given value), and then the local reconstruction weight matrix and local covariance matrix of the sample point are calculated. Finally, all sample points are mapped to a low-dimensional space according to certain mapping conditions for analysis of the final solution.

[0168] (4) Multilayer Perceptron Algorithm

[0169] Multilayer Perceptron (MLP) is one of the most important network models. Its network structure is as follows: Fig.11 As shown in the figure. A typical MLP network consists of an input layer, an output layer and at least one hidden layer. The perceptron is a special case of MLP, that is, an MLP without a hidden layer. The input signal passes through the hidden layer from the input layer to the output layer to form the output of the MLP. Therefore, MLP belongs to a forward network, also known as a static network. The computing power of the MLP neural network is concentrated in three aspects, namely, logical expression function, complex pattern classification ability and general functional approximation ability.

[0170] The training of MLP neural network is realized by the famous back propagation (BP) algorithm, which is a typical supervised training method. The basic idea of ​​BP algorithm is to transform the input and output problem of a set of samples into a nonlinear optimization problem, and use the gradient descent algorithm commonly used in optimization to minimize the mean square error (MSE) between the actual output and the expected output of the network, thus completing the training task of MLP neural network.

[0171] However, since the BP algorithm itself is a complex nonlinear optimization problem, there are still some practical problems that are difficult to solve in the application process. The main problem is that the BP algorithm may converge to a local minimum point during the learning process, so that the problem cannot be solved optimally, and the convergence speed is also very slow. In addition, the BP algorithm tends to forget the old samples that have been learned when learning new samples. In response to the above problems, many improved BP algorithms have been proposed, such as the BP algorithm with momentum factor η and the BP algorithm with adaptive learning constant α.

[0172] 1) MLP Classifier

[0173] The MLP neural network is used as a classifier mainly to take advantage of its powerful pattern classification ability. As mentioned earlier, the MLP neural network is essentially a posterior probability density estimator of a training sample, and therefore, it is a form of implementation of a Bayesian classifier. This is the mechanism by which the MLP network implements pattern classification. Existing research results have shown that a two-layer MLP neural network with one hidden layer can achieve any convex decision boundary. Later, it was further proved that a two-layer MLP neural network can achieve arbitrarily close approximation to any nonlinear continuous mapping. Therefore, pattern classification problems can usually be solved using a two-layer MLP neural network. However, this does not mean that networks with more than two layers are useless. For some application problems, using a two-layer network may require a very large number of hidden nodes, but this can be achieved using a very small three-layer network.

[0174] 2) Topological structure and training algorithm design of MLP network classifier

[0175] The design of the MLP network topology involves the determination of the number of nodes in the input and output layers, the number of hidden layers, and the number of nodes in each hidden layer. Obviously, the number of nodes in the input and output layers is equal to the dimensions of the classifier input and output vectors, respectively. Theory and practice show that the hidden layer of the MLP network does not need to be more than two layers. Usually, a two-layer network with one hidden layer can meet the needs of most applications. Therefore, the design of the MLP network generally starts with a two-layer MLP network, and the number of hidden nodes in the hidden layer is experimentally determined from less to more or from more to less using a heuristic method. If the two-layer MLP network cannot meet the needs, you can add a hidden layer.

[0176] Since the output of the MLP network classifier is only the asymptotic posterior probability density estimate of the sample to be identified in the test set, and does not directly specify the sample as the corresponding type, it is necessary to design a decision logic to complete the transformation from the posterior probability density of the test sample to the type of the sample.

[0177] The simplest decision logic does not have a rejection mechanism, so it is sufficient to just make a maximum value judgment on the output of the classifier. However, in communication signal recognition, in order to improve the reliability of recognition, it is usually necessary to set up a rejection mechanism, that is, to set up another rejection class. The rejected samples may be known type signals that are severely distorted and difficult to classify, or they may be new types of signals that the classifier has not "seen" yet, and can be further analyzed and identified by human workers.

[0178] (5) Network order flow classification based on multi-layer perceptron

[0179] The present invention intends to use an adaptive moment estimation algorithm to train the model. Compared with the stochastic gradient descent algorithm and the momentum-based algorithm, the algorithm can adaptively adjust the learning rate and set a different learning rate for each factor in the parameter, so that more suitable parameters can be quickly trained to obtain a detection model with higher generalization ability.

[0180] First, the vector output by the manifold learning model is used as the vector after feature extraction to learn the anomaly detection feature. Then, a combination of whitelist matching and single-class support vector machine algorithm is used to detect abnormal network traffic. For IP address and traffic type features, the whitelist matching method is used. IP addresses or traffic types that are not within the set whitelist range are directly judged as abnormal traffic. If the IP address and traffic type are normal, the learned anomaly detection features are used as input, and the single-class support vector machine algorithm is used to determine whether it is an anomaly. The network order flow detection flow chart is as follows: Fig.12 shown.

[0181] 5. Behavioral Anomaly Analysis Technology Based on Device Profiling

[0182] Taking all traffic generated by terminal devices as the inspection object, the terminal device's physical layer, network traffic and protocol behavior characteristics are comprehensively considered to establish a terminal device portrait. Based on the established device portrait, combined with deep learning methods, the network access behavior of the terminal is analyzed and detected to see if it is abnormal.

[0183] (1) Equipment image

[0184] 1) Basic Concepts

[0185] Taking all interactive traffic generated by the terminal as the investigation object, the study integrates the physical characteristics of the terminal, network traffic characteristics and business behavior characteristics, and establishes a device portrait of the terminal based on historical data to reflect the network behavior status of the terminal; based on device data, using labeling as a means, and taking devices as units, analyze device data by establishing a data model, extracting labels of various dimensions of the device, and the label set of the device is the constructed device portrait.

[0186] 2) Data

[0187] Data refers to symbols that record and identify objective events, and are physical symbols or combinations of these physical symbols that record the nature, state, and mutual relations of objective things. It is a recognizable, abstract symbol, not only referring to numbers in a narrow sense, but also to a combination of words, letters, digital symbols, graphics, images, videos, audio, etc. with certain meanings. It is also an abstract representation of the attributes, quantity, location, and mutual relations of objective things.

[0188] 3) Image technology

[0189] As a branch of big data science, portrait technology can perfectly and intuitively abstract all the information of an object. It uses concise labels to characterize the research object with multi-dimensional abstract data information as a qualitative and quantitative visual model, so that people can intuitively understand the characteristic information of the object. User portrait is a technology that marks users through highly refined feature identification, which abstracts the basic value information of the data into a combination of specific labels. User portrait is essentially a mathematical modeling of people in the real world. Its meaning mainly includes two aspects: the first portrait describes the users related to the business, and the second portrait is a model abstracted through the analysis of big data mining.

[0190] Although there are many different research results on user portraits, the basic technology is universal. Therefore, the present invention analyzes the power data of the transmission line in accordance with the method of user portraits. Through big data mining and analysis, the high-dimensional complex static data and dynamic data that affect the power status of the transmission line are converted into visual and visualized feature labels, making it easier for the network to obtain and analyze the operating status of the transmission line.

[0191] 4) Image tags

[0192] A tag is a tuple that contains both device-specific attributes and values. Attributes include tag name, tag type, valid range, timeliness, creation date, creator, and last modified date. The value of a tag represents a weight, and its type and value range are determined by the attribute. The attribute label of data is data judged by human experience, and is the data behind the data. What is important is the relationship between data and data, not the data itself. The realization of the value of big data lies in the connection between data and data. Tag management is a very important trend.

[0193] (2) Portrait Construction Case

[0194] The essence of terminal device portrait is to label the data information and characteristics of the device through algorithms. The terminal device portrait includes three aspects: terminal physical characteristics, network traffic characteristics and protocol behavior characteristics. For example, Fig.13As shown in the figure, the terminal physical characteristics include device performance attributes, physical channel characteristics, and signal time and frequency domain characteristics. Network traffic characteristics include basic connection characteristics, connection content characteristics, time-based traffic statistics characteristics, and host-based traffic statistics characteristics. Protocol behavior characteristics include protocol port number, source address, destination address, and other information.

[0195] Specific indicators of device profiling include:

[0196] 1) Characteristics of the terminal network physical channel, including phase, signal strength, multipath delay and other information;

[0197] 2) Time domain and frequency domain features of physical signal waveforms. The time domain features are directly extracted using one-dimensional convolution, and the frequency domain features are extracted by one-dimensional convolution of the frequency domain waveform after the time domain waveform undergoes Fourier transformation;

[0198] 3) Characteristics of network traffic, which are the characteristics after being characterized by the network flow order. Mainly the basic characteristics of TCP connections, such as protocol type, connection duration, etc. Characteristics of TCP connection content, such as the number of user visits, etc. Time-based traffic statistics characteristics, such as the number of connections with the same target host as the current host within a certain period of time. Host-based traffic statistics characteristics, such as the number of connections with the same target host and the same service as the current connection in the first 100 connections;

[0199] 4) Protocol behavior characteristics: characteristics formed after in-depth analysis of the protocol, mainly including protocol port number, source address, destination address, protocol keywords and other information.

[0200] (3) Abnormal analysis technology based on device portrait matrix

[0201] According to the device-related attributes extracted in the previous section, a device portrait matrix is ​​finally combined. Based on the device portrait matrix, the present invention proposes a device abnormal behavior analysis method based on convolutional neural network and long short-term memory network. The abnormal analysis model used is as follows Fig.14 As shown:

[0202] 1) Convolutional spatial feature extraction

[0203] The basic network structure of a convolutional neural network consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The model is generally designed as a combination of several convolutional layers and pooling layers. The normalized device portrait matrix X is input into the convolutional neural network and convolution and pooling operations are performed on it. The convolutional layer sets multiple convolution kernels W, with a convolution kernel size of d and a step size of 1. Each convolution kernel calculates the features in the convolution window d and generates a new feature. When a convolution kernel traverses each feature subsequence, the feature map generated by the convolution kernel is obtained. The feature maps generated by all convolution kernels are stacked to obtain a new feature sequence.

[0204] The pooling layer performs a pooling operation on the feature sequence generated after convolution. Commonly used pooling operations include average pooling and maximum pooling. Maximum pooling is used in the model of the present invention. First, the feature map is divided into N blocks through pooling, and the maximum values ​​in each block are sequentially spliced ​​together to obtain a vector of length N. Then, the vectors obtained by pooling all feature maps are spliced ​​to form the final result vector.

[0205] 2) Time series feature extraction

[0206] Long short-term memory network (LSTM) is mainly used to process data with time series characteristics. The output of each element in the sequence is not only related to the current input, but also to the previous state. Therefore, the long short-term memory network will memorize the previous information and apply it to the calculation of the current output. Because the data in each network flow has time series, such as the data packets of the TCP three-way handshake between two hosts and the data packets exchanged after the connection is established, the abnormal behavior detection of the device also needs to mine the time series related features in the network traffic data, and the past results should also be considered when detecting the current state.

[0207] In order to mine the deep temporal relationship between network traffic, this model uses a bidirectional long short-term memory network (BiLSTM) to process the feature vector P extracted in the CNN in the previous section. BiLSTM consists of two-directional LSTMs, and the output at each time step is collaboratively controlled by three gates: forget gate, input gate, and output gate. Each gate is related to the output of the previous module and the input at the current moment. These gates jointly determine how to update the state of the current memory cell and the current abnormal state. The pooled feature map sequence is regarded as a time series and input into the BiSLTM network. The output state of each feature before and after the feature is calculated through the BiLSTM network. The output of the last network unit in the forward direction is cascaded with the output of the last network unit in the reverse direction to obtain a vector containing the spatial and temporal features of the device portrait data.

[0208] 3) Softmax Classifier

[0209] In the process of building the anomaly detection classifier, the traffic depth features of the samples are first extracted based on CNN-BLSTM, then input into the softmax classifier, and the samples are output after processing.

Claims

1. A method for automatically discovering unknown attacks on power networks based on deep protocol analysis, characterized in that: The following steps are involved: Step 1: Establish comprehensive monitoring indicators from three levels: asset status, network traffic, and protocol instructions; Step 2: Study the automatic learning and construction technology of normal behavior benchmark models, establish a normal benchmark model based on multiple RBM neural networks, study normal behavior baselines such as power business operation behavior benchmarks, benchmarks for the same type of equipment, and benchmarks for specific communication lines, and build security baseline indicators for the normal behavior model of the power network; On this basis, the abnormal behavior detection technology based on the normal baseline model is studied; Step 3: Conduct abnormal behavior automatic discovery technology verification by using simulated network traffic and power network usage business data to verify the abnormal behavior automatic discovery technology.

2. According to claim 1, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: The indicators used for modeling normal network behavior in step 1 can be roughly divided into three categories: asset status indicators, network traffic indicators and protocol indicators.

3. According to claim 2, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: Asset status indicators include operational status, configuration compliance, logs, and system abnormal behavior; Operation status indicators include: CPU utilization, memory utilization, IO usage, network traffic, key processes, system service status, service port status, key file status, registry, startup items, kernel, hardware configuration, and operating system information; Configuration compliance indicators include: account policy, log policy, authorization policy, IP communication policy, password policy, service configuration, kernel parameter configuration and vulnerability patch status; Log indicators include: host logs, middleware logs, database logs, and various common application service logs; System abnormal behavior indicators include: abnormal network access behavior, abnormal process operation behavior, abnormal API call behavior, abnormal registry operation behavior, abnormal file read and write behavior, and malicious files.

4. According to claim 2, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: Network traffic metrics include: Transport protocol type, discrete type, there are 3 types: TCP, UDP, ICMP; The network service type of the target host, discrete type; Specific protocol type, such as power consumption information collection protocol; The network indicators of the terminal per unit time; the average length of the data packets sent and received by the terminal, the number of data packets sent by the terminal, the number of data packets received by the terminal, the number of service hosts connected to the terminal, and the number of ports used by the terminal; Indicators of terminal connection to host: number of ports used by the host, frequency of ports used by the host.

5. According to claim 2, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: Protocol indicators: The instruction indicators of the protocol include Afn and Fn fields.

6. According to claim 1, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: In step 2, the IoT architecture and common communication protocols are first analyzed, and the behavioral characteristics of the modeling business protocols are analyzed at the grammatical and semantic levels; Then, the key fields of the protocol are taken as the research objects, a protocol behavior model is established according to the frequency and sequence of the key fields of the protocol, and a behavior anomaly detection method based on business protocol messages is proposed; The behavior anomaly detection method based on business protocol messages includes the steps of selecting features of protocol data packets and establishing a sequence labeling model; In the abnormal protocol behavior detection, after collecting the data packet observation sequence X from the network data flow in units of network connections, the normality y_i is marked for each data packet, and then the labeling sequence Y is obtained, and the conditional random field is selected as the sequence labeling model; after the conditional random field model is established, the principle of using it for real-time protocol anomaly detection is that for the observation sequence XN' of a certain protocol in each network connection, N represents the length of the network connection, and each observation value corresponds to a protocol data packet. According to the established CRF model, if a protocol anomaly occurs in this connection, a normal labeling sequence YN=(1,1,…,1) is given, 1 represents the normal state, and the conditional probability p(y|x,θ) should be greater than the preset threshold pthr, and the protocol behavior is abnormal or not is determined according to the threshold.

7. According to claim 1, a method for automatically discovering unknown attacks on power networks based on deep protocol analysis is characterized in that: Step 2 includes the following steps: Step 21: extract indicators according to the network characteristics of the power information system network, and complete the preprocessing of the extracted data. The preprocessing includes: data collection, indicator extraction, normalization, and then merging the indicators according to the amount of flow data in the time period Ta; Step 22: The merged data is set as a training data set, and the time period is divided according to the common traffic transmission time of the network, and the data set is divided into various data clusters; Step 23: Build a baseline model; the baseline model consists of K RBM networks, where K is initialized to 1.

8. The method for automatically discovering unknown attacks on power networks based on deep protocol analysis according to claim 7 is characterized in that: Step 23 includes: 1) Randomly initialize an RBM network. The network parameters of the RBM network can be set to random numbers first. Then, the normalized index data is input into the RBM model. The network does not record the output of the hidden layer. The model training is completed by minimizing the error between the model output and the original input. The output process of the model is that the original index data is input into the visible layer, and then the hidden layer data is reversely trained to the output of the visible layer through hidden layer training. The RBM model obtained by the first data cluster training is set as the initial benchmark model. Input x i With the output y i The square root error is expressed as follows: 2) Take a data cluster, input the data cluster into each RBM model, test all RBM benchmark models in the benchmark model set, calculate the reconstructed output of the data cluster in the benchmark model, and calculate the square root error between the output data and the original data; 3) Compare all square root errors; If all square root errors ρ exceed the set threshold, it means that the data does not match any existing RBM network patterns, so the data belongs to a new pattern type. In this case, a new RBM network is created, randomly initialized, and the data cluster is input into the new RBM network for training, and the network parameters are adjusted. The RBM network is added to the benchmark model. If some square root errors are within the threshold range, select the model set with the smallest square root error ρ, add the original data of the data cluster into the data set of the corresponding benchmark model; if there are too many data in the data set, randomly discard some redundant data according to the set data set amount, train a new data set and update the corresponding benchmark model parameters; Minimum square root error ρ = min{pj}, j is the jth model 4) Return to step 2) until all data training is completed; 5) According to the number of data clusters in the RBM model after clustering, the abnormality of each data cluster is set. The more data clusters there are in the RBM model, the more the model conforms to the network segment transmission law, and the lower the abnormality of the corresponding data cluster; Abnormality Where n is the data cluster data in the RBM model, and N is the number of all data clusters; 6) Set an abnormality detection threshold, aggregate the RBM models that meet the abnormality threshold, and aggregate them into a multi-RBM model set. The model set corresponds to multiple RBM models. The number of RBM models is K. Each RBM model corresponds to its own parameters and data cluster. The multi-RBM model set is the normal benchmark model of the network.

9. The method for automatically discovering unknown attacks on power networks based on deep protocol analysis according to claim 1 is characterized in that: Starting from the network flow attributes, the composition of the network flow order is designed; manifold learning is studied and a network flow order characterization scheme is proposed based on manifold learning; the multi-layer perceptron algorithm is studied and a network flow order classification method based on the multi-layer perceptron is proposed.

Images