Smart grid DoS attack detection method, system, medium, equipment and program

Abstract

The present invention relates to the field of network traffic technology, and provides a method, system, medium, device and program for detecting Dos attacks on a smart grid. The method for detecting Dos attacks on a smart grid comprises: merging three features corresponding to the same network traffic data to construct a fusion feature set; using the fusion feature set and the corresponding numerical label set as input, respectively using a support vector machine and a decision tree to obtain a first output set and a second output set; inputting the first output set, the second output set and the corresponding numerical label set into a classifier to obtain the weight of the support vector machine and the weight of the decision tree to construct a multi-level decision model; considering multiple performance indicators, constructing a comprehensive multi-dimensional objective function, optimizing the hyperparameters of the multi-level decision model, and obtaining an optimized multi-level decision model for Dos attack detection of network traffic. The present invention can quickly identify DoS attack behaviors in smart grids and ensure the safe operation of smart grids.

Description

Technical Field

[0001] The present invention relates to the field of network traffic technology, and in particular to a method, system, medium, equipment and program for detecting DoS attacks in a smart grid. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] DoS attacks send a large number of forged requests, occupy network resources, and prevent legitimate users from accessing services normally. DoS attacks are carried out in a variety of ways, including but not limited to flood attacks, Ping of Death, SYN Flood, and UDP Flood. By consuming network bandwidth, occupying system resources, and even causing server crashes, the normal communication process of the power system is seriously disrupted. Communication interruption will not only affect the real-time monitoring, control command transmission, and alarm information transmission of the power system, but may also lead to the interruption of key services, which in turn will trigger a series of chain reactions and affect the stability and reliability of power supply. In the most serious cases, DoS attacks may cause partial or complete paralysis of the power system, causing huge economic losses and safety hazards to society.

[0004] In the prior art, only one classification model is used to detect DoS attacks on network traffic data. The detection accuracy is limited by the classification model itself, and the detection accuracy is not high. Summary of the invention

[0005] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a smart grid DoS attack detection method, system, medium, device and program. The present invention can be used for DoS attack detection in smart grids, aiming to quickly identify attack behaviors and ensure the safe operation of smart grids.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A first aspect of the present invention provides a smart grid DoS attack detection method.

[0008] A smart grid DoS attack detection method, comprising:

[0009] Based on the obtained network traffic data set, three feature sets are obtained by using linear regression algorithm, classifier and random forest algorithm respectively; the three features corresponding to the same network traffic data are merged to construct a fusion feature set;

[0010] The fused feature set and the corresponding numerical label set are used as input, and a support vector machine (SVM) and a decision tree are used respectively to obtain a first output set and a second output set; the first output set, the second output set and the corresponding numerical label set are input into a classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree;

[0011] Considering multiple performance indicators, a comprehensive multidimensional objective function is constructed, and the hyperparameters of the multi-level decision model are optimized to obtain the optimized multi-level decision model for DoS attack detection of network traffic.

[0012] Furthermore, the comprehensive multidimensional objective function is expressed by the following formula:

[0013]

[0014] in, represents the hyperparameter vector; Indicates the current data set; Represents prior information Represents the acquisition function; Indicates the number of performance indicators; is the weight of the cth performance indicator, and the same weight is assigned to each performance indicator; Represents the function of the c-th performance indicator.

[0015] Furthermore, the first output set, the second output set and the corresponding numerical label set are input into the classifier to obtain the weight of the support vector machine and the weight of the decision tree, which are expressed by the following formula:

[0016]

[0017] in, Represents the difference between the predicted value of the preliminary classification and the numerical label in the training set, represents the weight of the support vector machine; represents the weight of the decision tree, represents the set of numerical labels in the training set, Represents the numerical labels in the training set.

[0018] Furthermore, the multiple performance indicators include accuracy, weighted precision, weighted recall and weighted F1 score.

[0019] Furthermore, the method for optimizing the hyperparameters of the multi-level decision-making model includes: optimizing the hyperparameters of the multi-level decision-making model using a Bayesian optimization method.

[0020] Furthermore, the three features corresponding to the same network traffic data are merged to construct a fusion feature set, which is expressed by the following formula:

[0021]

[0022] in, Represents the feature set selected by the linear regression algorithm; Represents the feature set filtered by the classifier; Represents the feature set selected by the random forest algorithm; Represents the final fusion feature set.

[0023] Furthermore, after the network traffic data set is obtained, it also includes: converting the network traffic data set into a network traffic data table, performing data cleaning on the network traffic data table, removing missing values ​​and duplicate values ​​in the network traffic data table, and processing abnormal values ​​in the network traffic data table.

[0024] Furthermore, the numerical label set is obtained by encoding the label set.

[0025] A second aspect of the present invention provides a smart grid DoS attack detection system.

[0026] A smart grid DoS attack detection system, comprising:

[0027] The feature processing module is configured to: based on the acquired network traffic data set, respectively use a linear regression algorithm, a classifier and a random forest algorithm to obtain three feature sets; merge the three features corresponding to the same network traffic data to construct a fusion feature set;

[0028] The model training module is configured to: take the fusion feature set and the corresponding numerical label set as input, respectively adopt a support vector machine and a decision tree to obtain a first output set and a second output set; input the first output set, the second output set and the corresponding numerical label set into a classifier, obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree;

[0029] The model optimization module is configured to: consider multiple performance indicators, construct a comprehensive multi-dimensional objective function, optimize the hyperparameters of the multi-level decision model, and obtain an optimized multi-level decision model for Dos attack detection of network traffic.

[0030] A third aspect of the present invention provides a computer-readable storage medium.

[0031] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the smart grid DoS attack detection method as described in the first aspect above.

[0032] A fourth aspect of the present invention provides a computer device.

[0033] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the smart grid DoS attack detection method as described in the first aspect above are implemented.

[0034] A fifth aspect of the present invention provides a computer program product or a computer program.

[0035] A computer program product or a computer program, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in the smart grid DoS attack detection method as described in the first aspect above.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] The present invention proposes a smart grid Dos attack detection method. Based on the acquired network traffic data set, the data in the data set is first cleaned, missing values ​​and duplicate values ​​in the data set are removed, and abnormal values ​​in the data set are processed. Secondly, a linear regression algorithm, a classifier and a random forest algorithm are respectively used to obtain three feature sets; the three features corresponding to the same network traffic data are merged to construct a fusion feature set; the fusion feature set and the corresponding numerical label set are used as input, and a support vector machine (SVM) and a decision tree are respectively used to obtain a first output set and a second output set; the first output set, the second output set and the corresponding numerical label set are input into the classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree; considering multiple performance indicators, a comprehensive multi-dimensional objective function is constructed, and the hyperparameters of the multi-level decision model are optimized to obtain an optimized multi-level decision model for Dos attack detection of network traffic. The present invention continuously monitors the network traffic in the smart grid, comprehensively applies three methods, namely linear regression algorithm, classifier and random forest algorithm, to extract traffic features, and performs analysis based on the traffic features. The present invention can more comprehensively and accurately identify key features that have an important impact on model performance. The present invention performs real-time analysis of the power grid network traffic through a multi-level decision model, can identify normal traffic patterns and detect potential abnormal behaviors, and then accurately identify DoS attack abnormal traffic that affects the stability of the power grid, and provide decision support for power grid operators based on the analysis results, including adjusting resource allocation and optimizing power grid operation strategies, thereby improving the overall performance and reliability of the power grid system.

[0038] The present invention uses multiple performance indicators to construct a comprehensive multi-dimensional objective optimization model to comprehensively evaluate the model performance and avoid a single indicator that cannot reflect the performance of the model in different scenarios. By simultaneously optimizing multiple indicators such as accuracy, precision, weighted recall, weighted F1 score, etc., it is possible to balance the conflicts between different goals and find the optimal balance of various indicators, thereby avoiding excessive bias towards a certain goal. In addition, multi-objective optimization helps to improve the robustness of the model, reduce overfitting, and make the model more stable when dealing with complex data sets and changing environments, so as to improve the robustness of DoS attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0040] Figure 1 It is a flow chart of a DoS attack detection method based on a machine learning multi-level decision model shown in the present invention;

[0041] Figure 2 is an experimental result diagram of feature selection based on Lasso shown in the present invention;

[0042] Figure 3 It is an experimental result diagram of feature selection based on XGBoost classifier shown in the present invention;

[0043] Figure 4 1 is a graph showing experimental results of feature selection based on random forests shown in the present invention;

[0044] Figure 5 This is a graph showing the performance analysis results of a multi-level decision model based on machine learning shown in the present invention. DETAILED DESCRIPTION

[0045] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0046] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0047] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0048] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the methods and systems according to various embodiments of the present disclosure. It should be noted that each box in the flowchart or block diagram can represent a module, a program segment, or a part of a code, and the module, program segment, or a part of a code may include one or more executable instructions for implementing the logical functions specified in each embodiment. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the flowchart and / or block diagram, and the combination of boxes in the flowchart and / or block diagram can be implemented using a dedicated hardware-based system that performs a specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0049] Embodiment 1

[0050] The present embodiment provides a method for detecting Dos attacks in a smart grid. The present embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal, a server, and a server, and is implemented through the interaction between the terminal and the server. The server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communications, middleware services, domain name services, security services CDN, and big data and artificial intelligence platforms. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in this application. In the present embodiment, the method includes the following steps:

[0051] Based on the obtained network traffic data set, three feature sets are obtained by using linear regression algorithm, classifier and random forest algorithm respectively; the three features corresponding to the same network traffic data are merged to construct a fusion feature set;

[0052] The fused feature set and the corresponding numerical label set are used as input, and a support vector machine (SVM) and a decision tree are used respectively to obtain a first output set and a second output set; the first output set, the second output set and the corresponding numerical label set are input into a classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree;

[0053] Considering multiple performance indicators, a comprehensive multidimensional objective function is constructed, and the hyperparameters of the multi-level decision model are optimized to obtain the optimized multi-level decision model for DoS attack detection of network traffic.

[0054] The present invention uses a multi-level decision-making model to perform real-time analysis of power grid network traffic, which can identify normal traffic patterns and detect potential abnormal behaviors, and then accurately identify DoS attack abnormal traffic that affects power grid stability, and provide decision support for power grid operators based on the analysis results, including adjusting resource allocation and optimizing power grid operation strategies.

[0055] The implementation process of the present invention is described in detail below. Figure 1 As shown:

[0056] Step (1): When processing the CSE-CIC-IDS2018 network traffic dataset, import the data into PandasDataFrame, remove missing values ​​and duplicate values ​​through data cleaning, and process outliers to improve data quality. Use LabelEncoder to convert classification labels into numerical form, laying the foundation for feature extraction, model training and optimization.

[0057] Step (2): In order to improve the performance and computational efficiency of the model and effectively reduce the overfitting phenomenon of the model and the interference of data noise on the prediction results, the present invention comprehensively applies three methods: linear regression algorithm, classifier and random forest to perform feature selection. The Lasso regression algorithm is selected in the linear regression algorithm, and the XGBoost classifier is selected as the classifier. The Lasso regression evaluates the importance of the feature by applying L1 regularization, the XGBoost evaluates the importance of the feature based on the split gain, and the random forest selects the features by Gini importance, merges and removes duplicate features, so as to identify the key features that are critical to the model performance.

[0058] Step (3): After data processing is completed, the data set is divided into 70% for training and 30% for testing to ensure the adequacy of model training and evaluation. SVM and decision tree are used for preliminary classification, and XGBoost is used as the final classifier to build a multi-level decision model to improve the generalization ability and robustness of the multi-level decision model.

[0059] Step (4): In order to improve the robustness of the model, the Bayesian optimization method is used to tune the hyperparameters of the multi-level decision model based on multi-dimensional objectives. The process includes initializing the hyperparameter sample, iterative optimization until the best hyperparameter combination is found, and after the tuning is completed, the generalization ability and stability of the model are evaluated through 3-fold cross validation.

[0060] Step (5): After the hyperparameters are updated, the multi-level decision model is retrained to fully utilize the optimal parameters and evaluated on the test set to generate accuracy, weighted precision, weighted recall, and weighted F1 score indicators. The trained model can analyze power grid network traffic in real time and accurately identify normal traffic and DoS attack abnormal traffic, thereby providing decision support for power grid operators and optimizing resource allocation and power grid operation strategies.

[0061] Specifically, the currently public network traffic dataset CSE-CIC-IDS2018 is used in step (1). The dataset has more than 1 million data records, including four types of abnormal traffic data: DoS Hulk, DoS GoldenEye, and DoS Slowhttptest. The data in the dataset is imported into Pandas DataFrame for processing. The specific features include target port, traffic duration, total number of forward and backward packets, total length of forward and backward packets, maximum, minimum, average length and standard deviation of forward and backward packets, number of bytes of traffic transmitted per second, number of traffic packets transmitted per second, average time interval of traffic arrival, forward and backward arrival time interval, forward and backward push flag and urgent flag, header length, number of forward and backward packets transmitted per second, packet length, TCP flag count, download / upload ratio, average packet size, average number of bytes and packets per batch in forward and backward, number of packets and bytes of subflow forward and backward, number of bytes of initial forward and backward window, number of active packets in forward, forward segment size, and data label. The dataset is large in size and covers many types of DoS attacks, providing a rich information basis for analyzing and detecting network attacks. Through these features, detailed understanding of the specific behavior patterns of each flow is critical for identifying and classifying different types of network traffic, such as normal traffic and DoS attack traffic. Furthermore, it supports subsequent stages such as feature extraction, cleaning processing, modeling training and optimization, laying a solid foundation for the development of the entire attack detection and response system.

[0062]

[0063] in, Indicates that the data set is converted into a data table, where Indicates a read operation on a data set. Indicates the name of the dataset.

[0064] In order to ensure the integrity, accuracy and consistency of the data, Clean the data table to avoid the negative impact of data noise and redundant information on model training, and remove missing values ​​and duplicate values ​​in the data table.

[0065]

[0066] in, express Delete the data table containing the missing value rows; Indicates from A function to delete rows containing missing values ​​from a data table; express Rows in a data table; Represents a function that detects if there are missing values ​​in a row.

[0067]

[0068] in, express Delete duplicate rows from the data table; Indicates from Delete the data table containing duplicate rows; Represents a function that detects whether a row is a duplicate.

[0069] In addition, by processing outliers, the quality of the data can be improved, making the data that the model is exposed to during training and testing more reliable, improving the performance, computational efficiency, and prediction accuracy of the model, thereby achieving better results in attack detection and traffic management.

[0070]

[0071] in, express The data table after processing outliers; represents a function used to replace or remove outliers; express Infinite values ​​or Nan values ​​in the data table.

[0072] To convert the categorical labels into numerical form, the labels are encoded using LabelEncoder so that the machine learning model can process the labeled data.

[0073]

[0074] in, Represents a primitive string type tag; represents the encoding function applied to string labels; Represents the encoded numeric label.

[0075] Specifically, in step (2), the present invention adopts a feature selection strategy that combines three methods: Lasso regression, XGBoost classifier and random forest, aiming to improve the performance, computational efficiency and interpretability of the model while reducing the impact of overfitting and data noise.

[0076] First, Lasso regression imposes sparsity constraints on the regression coefficients of some features when optimizing the model by introducing the L1 regularization term. Lasso regression tends to reduce unimportant feature coefficients to zero, thereby effectively removing redundant features. Features corresponding to non-zero coefficients with weight values ​​above the 90th percentile are selected.

[0077]

[0078] in, Represents the optimized characteristic coefficient vector; represents the characteristic coefficient vector to be optimized; Indicates the size of the data set; Indicates the total number of features; Indicates The true labels of samples; Indicates The feature vector of samples; Indicates The predicted value of samples; A hyperparameter representing the strength of regularization, which controls the strength of feature selection; is an index used to iterate over the characteristic coefficients.

[0079] For each feature, XGBoost calculates the number of splits and split gains in all trees, reflecting its importance to model prediction. Features with importance values ​​above the 90th percentile are selected.

[0080]

[0081] in, Represents the final prediction output of the model. represents the input feature vector; Represents the total number of decision trees in the model; Indicates A decision tree for input features The prediction results; Indicates The weight of a decision tree.

[0082] Random forest selects features by Gini importance, selecting features with Gini importance values ​​above the 90th percentile.

[0083]

[0084] in, Indicates the importance value of the feature; Represents a node in a decision tree; Indicates the ratio (weight) of the number of samples contained in the node to the total number of samples; It indicates the purity reduction value brought by the node splitting, that is, the change in purity before and after the node splitting.

[0085] By merging the features screened out by the above three methods and removing duplicate features, the key features that have an important impact on the model performance can be identified more comprehensively and accurately.

[0086]

[0087] in, Represents the feature set selected by the linear regression algorithm (Lasso regression); Represents the feature set selected by the classifier (XGBoost); Represents the feature set selected by the random forest algorithm; Represents the final fusion feature set.

[0088] In some embodiments, after the data is processed in step (3), the processed data is divided into a training set at a ratio of 70%, and the remaining 30% is used as a test set to ensure that the model can be trained on sufficient data, while retaining a portion of the data for model performance evaluation. Support vector machines and decision trees are used for preliminary classification, and XGBoost is used as the final classifier to build a multi-level decision model.

[0089] By inputting the prediction results of SVM and decision tree into XGBoost, XGBoost adjusts the weights of the outputs of SVM and decision tree. XGBoost will learn and evaluate the accuracy of SVM and decision tree based on the actual labels in the training data.

[0090]

[0091] in, represents the predicted value of each model, ; Indicates the number of training data sets; Represents the final prediction result.

[0092] XGBoost automatically assigns higher weights to models that perform better, thus relying more on them in the final integrated prediction.

[0093]

[0094] in, Represents the difference between the predicted value of the preliminary classification and the numerical label in the training set; Represents the weight of SVM; represents the weight of the decision tree, Represents the numerical labels in the training set.

[0095] The present invention effectively combines the high-dimensional data processing capability and nonlinear classification capability of SVM with the good capture capability of decision tree for feature interactions, and at the same time, through the weight adjustment mechanism of XGBoost, further improves the generalization ability of the model, reduces the risk of overfitting, and enhances robustness.

[0096] In some embodiments, in step (4), in order to improve the performance and stability of the model, the multi-level decision model is subjected to hyperparameter tuning by a Bayesian optimization method. The specific process includes: initializing a set of random samples of hyperparameters, and calculating the model performance under the random samples. Subsequently, new hyperparameters are selected for testing. The above process is iterated continuously until a hyperparameter combination that optimizes the model performance is found. In addition, the present invention designs a multi-objective Bayesian optimization algorithm, and considers multiple performance indicators (such as accuracy, precision, weighted recall rate, weighted F1 score, etc.) at the same time, so that hyperparameter tuning not only focuses on a single performance improvement, but also integrates multi-dimensional objectives. Using multiple performance indicators to construct a comprehensive multi-dimensional objective optimization model can comprehensively evaluate the model performance and avoid a single indicator being unable to reflect the performance of the model in different scenarios. By simultaneously optimizing multiple indicators such as accuracy, precision, weighted recall rate, weighted F1 score, etc., it is possible to balance the conflicts between different objectives and find the optimal balance of various indicators, thereby avoiding excessive bias towards a certain objective. In addition, multi-objective optimization helps to improve the robustness of the model, reduce overfitting, and make the model more stable when dealing with complex data sets and changing environments. This method can also adaptively adjust the optimization weights according to different application scenarios to ensure that the priority requirements of the model in specific tasks are met, significantly improve its actual application effect, and improve the efficiency of hyperparameter tuning.

[0097]

[0098] in, represents the hyperparameter vector; Indicates the current data set; Represents prior information Represents the acquisition function; Indicates the number of performance indicators, which is 4; is the weight of the cth performance indicator, and the same weight is assigned to each performance indicator; Represents the function of the c-th performance indicator.

[0099]

[0100] in, represents the new hyperparameter vector selected according to the get function.

[0101] After completing the hyperparameter tuning, the performance of the tuned model is evaluated using the cross-validation method. Cross-validation divides the dataset into three folds, trains and tests the model on each fold one by one, and obtains the average performance indicators of the model on different data subsets, which helps to effectively evaluate the generalization ability and stability of the model.

[0102] Cross-validation in Bayesian Optimization:

[0103]

[0104] in, represents the maximum a posteriori estimate of the hyperparameter θ, by maximizing all k It is found by adding the log-likelihood on the fold validation set and the log-prior, which combines the performance of the model on different data subsets and the prior knowledge of the parameters to find the optimal parameter setting; Indicates that it is k fold validation set; It means that given the hyperparameters Next, observe k The probability of a fold validation set is usually related to the performance of the model on this validation set. Indicates randomly splitting the data set into K subsets of equal size, which is 3. represents the prior probability distribution of the hyperparameter θ.

[0105] In some embodiments, after the hyperparameters are updated in step (5), the multi-level decision model is retrained to ensure that the model can fully utilize the newly determined optimal parameters. To evaluate the generalization ability of the model, the trained model is applied to the test set and prediction results are generated, including accuracy, classification report, weighted precision, weighted recall and weighted F1 score.

[0106] Accuracy Calculation:

[0107]

[0108] in, Indicates the number of samples correctly predicted by the model as positive; Indicates the number of samples that the model correctly predicts as negative; Indicates the number of samples that the model incorrectly predicts as positive; Indicates the number of samples that the model incorrectly predicts as negative.

[0109]

[0110] in, represents weighted precision; Indicates the number of categories; Indicates The weight of a category is usually determined by the number of samples in that category.

[0111]

[0112] in, represents the weighted recall.

[0113]

[0114] Denotes the weighted F1 score.

[0115] The present invention first uses the CSE-CIC-IDS2018 network traffic data set to train the model, which covers 79 features such as source IP, target IP, port number, traffic size, and number of packets. In order to ensure data quality and consistency, the collected data is cleaned and preprocessed to remove noise and irrelevant information, and the data is standardized. Then, the label is converted to a numerical type and encoded by LabelEncoder. In the preprocessed traffic data, the feature importance is determined by Lasso regression, XGBoost classifier, and random forest, respectively, and the features with weight values ​​or importance values ​​higher than the threshold are selected, and the features selected by the three methods are deduplicated and merged. Subsequently, the data set is divided into a training set and a test set at a ratio of 7:3, and the data is preliminarily classified using support vector machine (SVM) and decision tree, and XGBoost is used as the final classifier to construct a multi-level decision model; considering multi-dimensional targets, and by the Bayesian optimization method, the multi-level decision model is hyperparameter tuned, and the model performance is evaluated using cross-validation. Finally, network traffic data is collected in real time in the smart grid system, and a trained multi-level decision model is used to detect whether a DoS attack exists. The present invention continuously monitors the network traffic in the smart grid, and extracts traffic features by comprehensively applying three methods: Lasso regression, XGBoost classifier, and random forest. The present invention performs analysis based on traffic features. The present invention can more comprehensively and accurately identify key features that have an important impact on model performance, identify abnormal behaviors in real time, and detect DoS attacks, thereby improving the overall performance and reliability of the power grid system.

[0116] Figure 2 For Lasso regression, the L1 regularization term is introduced to achieve feature selection. The traffic features (maximum packet length, initial forward window byte number, minimum packet length, number of sub-flow forward packets, ACK flag count, PSH flag count, forward header length, and minimum forward segment size) are selected in the figure. Figure 2 It can be seen that the importance value of the minimum forward segment size is the largest, and the importance value of the maximum data packet length is the smallest.

[0117] Figure 3 XGBoost determines the contribution of features to the model's predictive ability by analyzing the contribution of features in the process of building the model, and gives priority to features with high contribution. The flow features (initial reverse window bytes, flow bytes per second, minimum flow arrival time, downlink / uplink ratio, flow arrival time standard deviation, forward arrival time sum, forward arrival time average, and forward segment size minimum) are selected in the figure. Figure 3 It can be seen that the importance value of the minimum forward segment size is the largest, and the importance value of the initial reverse window byte number is the smallest.

[0118] Figure 4 For random forest, Gini importance is used to filter out the features with high importance. In the figure, traffic features (average packet length, total length of forward packets, number of forward bytes of subflows, maximum packet length, average packet size, forward header length, initial forward window bytes, minimum forward segment size) are selected. Figure 4 It can be seen that the importance value of the minimum forward segment size is the largest, and the importance value of the average data packet length is the smallest.

[0119] Figure 5 The features screened by the present invention through multiple methods and duplicate items are eliminated, which can more effectively identify the features that are critical to the performance of the model. The trained multi-level decision model was tested for performance, with an accuracy rate of 99.986%, a precision rate of 99.9876%, a recall rate of 99.986%, and an F1 score of 99.9879%. Therefore, the multi-level decision model has extremely high prediction accuracy and reliability.

[0120] Embodiment 2

[0121] This embodiment provides a smart grid DoS attack detection system.

[0122] A smart grid DoS attack detection system, comprising:

[0123] The feature processing module is configured to: based on the acquired network traffic data set, respectively use a linear regression algorithm, a classifier and a random forest algorithm to obtain three feature sets; merge the three features corresponding to the same network traffic data to construct a fusion feature set;

[0124] The model training module is configured to: take the fused feature set and the corresponding numerical label set as input, respectively adopt a support vector machine and a decision tree to obtain a first output set and a second output set; input the first output set, the second output set and the corresponding numerical label set into an XGBoost classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree;

[0125] The model optimization module is configured to: consider multiple performance indicators, construct a comprehensive multi-dimensional objective function, optimize the hyperparameters of the multi-level decision model, and obtain an optimized multi-level decision model for Dos attack detection of network traffic.

[0126] In some embodiments, the comprehensive multidimensional objective function is expressed by the following formula:

[0127]

[0128] in, represents the hyperparameter vector; Indicates the current data set; Represents prior information Represents the acquisition function; Indicates the number of performance indicators; is the weight of the cth performance indicator, and the same weight is assigned to each performance indicator; Represents the function of the c-th performance indicator.

[0129] In some embodiments, the first output set, the second output set, and the corresponding numerical label set are input into the classifier to obtain the weight of the support vector machine and the weight of the decision tree, which are expressed by the following formula:

[0130]

[0131] in, Represents the difference between the predicted value of the preliminary classification and the numerical label in the training set, represents the weight of the support vector machine; represents the weight of the decision tree, represents the set of numerical labels in the training set, Represents the numerical labels in the training set.

[0132] In some embodiments, the plurality of performance metrics includes accuracy, weighted precision, weighted recall, and weighted F1 score.

[0133] In some embodiments, the method for optimizing the hyperparameters of the multi-level decision model includes: optimizing the hyperparameters of the multi-level decision model using a Bayesian optimization method.

[0134] In some embodiments, the three features corresponding to the same network traffic data are merged to construct a fusion feature set, which is expressed by the following formula:

[0135]

[0136] in, Represents the feature set selected by the linear regression algorithm; Represents the feature set filtered by the classifier; Represents the feature set selected by the random forest algorithm; Represents the final fusion feature set.

[0137] In some embodiments, after obtaining the network traffic data set, it also includes: converting the network traffic data set into a network traffic data table, performing data cleaning on the network traffic data table, removing missing values ​​and duplicate values ​​in the network traffic data table, and processing abnormal values ​​in the network traffic data table.

[0138] In some embodiments, the numerical label set is obtained by encoding the label set.

[0139] The present invention first uses the CSE-CIC-IDS2018 network traffic data set to train the model, which covers 79 features such as source IP, target IP, port number, traffic size, and number of packets. In order to ensure data quality and consistency, the collected data is cleaned and preprocessed to remove noise and irrelevant information, and the data is standardized. Then, the label is converted to a numerical type and encoded by LabelEncoder. In the preprocessed traffic data, the feature importance is determined by Lasso regression, XGBoost classifier, and random forest, respectively, and the features with weight values ​​or importance values ​​higher than the threshold are selected, and the features selected by the three methods are deduplicated and merged. Subsequently, the data set is divided into a training set and a test set at a ratio of 7:3, and the data is preliminarily classified using support vector machine (SVM) and decision tree, and XGBoost is used as the final classifier to construct a multi-level decision model; considering multi-dimensional targets, and by the Bayesian optimization method, the multi-level decision model is hyperparameter tuned, and the model performance is evaluated using cross-validation. Finally, network traffic data is collected in real time in the smart grid system, and a trained multi-level decision model is used to detect whether a DoS attack exists. The present invention continuously monitors the network traffic in the smart grid, and uses three methods, Lasso regression, XGBoost classifier, and random forest, to extract traffic features. Based on the traffic features, the analysis is performed, and abnormal behavior can be identified in real time and DoS attacks can be detected, thereby improving the overall performance and reliability of the power grid system.

[0140] Embodiment 3

[0141] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the smart grid DoS attack detection method described in the first embodiment are implemented.

[0142] Embodiment 4

[0143] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the smart grid DoS attack detection method described in the first embodiment are implemented.

[0144] Embodiment 5

[0145] This embodiment provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in the above-mentioned smart grid DoS attack detection method.

[0146] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A smart grid DoS attack detection method, characterized in that: include: Based on the obtained network traffic data set, three feature sets are obtained by using linear regression algorithm, classifier and random forest algorithm respectively; The three features corresponding to the same network traffic data are merged to construct a fusion feature set; Taking the fused feature set and the corresponding numerical label set as input, a support vector machine and a decision tree are used respectively to obtain a first output set and a second output set; Input the first output set, the second output set and the corresponding numerical label set into the XGBoost classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree; Considering multiple performance indicators, a comprehensive multi-dimensional objective function is constructed, and the hyperparameters of the multi-level decision model are optimized to obtain the optimized multi-level decision model for Dos attack detection of network traffic; The first output set, the second output set, and the corresponding numerical label set are input into the XGBoost classifier to obtain the weight of the support vector machine and the weight of the decision tree, and the method includes: By inputting the prediction results of the support vector machine and decision tree into the XGBoost classifier, the XGBoost classifier adjusts the weights of the outputs of the support vector machine and decision tree. The XGBoost classifier learns and evaluates the accuracy of the support vector machine and decision tree based on the actual labels in the training data. in, represents the predicted value of each model, ; Indicates the number of training data sets; Indicates the final prediction result; in, Represents the difference between the predicted value of the preliminary classification and the numerical label in the training set; Represents the weight of SVM; represents the weight of the decision tree, Represents the numerical labels in the training set.

2. The smart grid DoS attack detection method according to claim 1 is characterized in that: The comprehensive multidimensional objective function is expressed by the following formula: in, represents the hyperparameter vector; Indicates the current data set; Represents prior information Represents the acquisition function; Indicates the number of performance indicators; is the weight of the cth performance indicator, and the same weight is assigned to each performance indicator; Represents the function of the c-th performance indicator.

3. The smart grid DoS attack detection method according to claim 1 is characterized in that: The multiple performance indicators include accuracy, weighted precision, weighted recall and weighted F1 score.

4. The smart grid DoS attack detection method according to claim 1, characterized in that: The method for optimizing the hyperparameters of the multi-level decision-making model includes: optimizing the hyperparameters of the multi-level decision-making model using a Bayesian optimization method.

5. The smart grid DoS attack detection method according to claim 1 is characterized in that: The three features corresponding to the same network traffic data are merged to construct a fusion feature set, which is expressed by the following formula: in, Represents the feature set selected by the linear regression algorithm; Represents the feature set filtered by the classifier; Represents the feature set selected by the random forest algorithm; Represents the final fusion feature set.

6. The smart grid DoS attack detection method according to claim 1 is characterized in that: After the network traffic data set is obtained, the method also includes: converting the network traffic data set into a network traffic data table, performing data cleaning on the network traffic data table, removing missing values ​​and duplicate values ​​in the network traffic data table, and processing abnormal values ​​in the network traffic data table.

7. The smart grid DoS attack detection method according to claim 1, characterized in that: The numerical label set is obtained by encoding the label set.

8. Smart grid Dos attack detection system, characterized by: include: The feature processing module is configured to: based on the acquired network traffic data set, respectively use a linear regression algorithm, a classifier and a random forest algorithm to obtain three feature sets; merge the three features corresponding to the same network traffic data to construct a fusion feature set; The model training module is configured to: take the fused feature set and the corresponding numerical label set as input, respectively adopt a support vector machine and a decision tree to obtain a first output set and a second output set; input the first output set, the second output set and the corresponding numerical label set into an XGBoost classifier to obtain the weight of the support vector machine and the weight of the decision tree, so as to construct a multi-level decision model based on the support vector machine and the decision tree; A model optimization module is configured to: consider multiple performance indicators, construct a comprehensive multi-dimensional objective function, optimize the hyperparameters of the multi-level decision model, and obtain an optimized multi-level decision model for DoS attack detection of network traffic; The first output set, the second output set, and the corresponding numerical label set are input into the XGBoost classifier to obtain the weight of the support vector machine and the weight of the decision tree, and the method includes: By inputting the prediction results of the support vector machine and decision tree into the XGBoost classifier, the XGBoost classifier adjusts the weights of the outputs of the support vector machine and decision tree. The XGBoost classifier learns and evaluates the accuracy of the support vector machine and decision tree based on the actual labels in the training data. in, represents the predicted value of each model, ; Indicates the number of training data sets; Indicates the final prediction result; in, Represents the difference between the predicted value of the preliminary classification and the numerical label in the training set; Represents the weight of SVM; represents the weight of the decision tree, Represents the numerical labels in the training set.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the smart grid DoS attack detection method as described in any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the smart grid DoS attack detection method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps in the smart grid DoS attack detection method according to any one of claims 1 to 7 are implemented.

Images