Network security detection method and device for power Internet of Things, and electronic equipment

Abstract

The invention discloses a network security detection method and device for a power internet of things, and electronic equipment. The method comprises the following steps: acquiring data packets corresponding to a plurality of pieces of power Internet of Things equipment in the power Internet of Things in a current sampling period to obtain a plurality of initial data packets; determining a plurality of target data packets from the plurality of initial data packets based on a predetermined matching rule, and determining first anomaly recognition results corresponding to the plurality of target data packets; constructing a target network traffic distribution diagram based on the plurality of target data packets, and determining second anomaly recognition results corresponding to the plurality of target data packets; and based on the first anomaly identification result and the second anomaly identification result, determining a network security detection result of the power Internet of Things in the current sampling time period. According to the method and the device, the technical problem of low network security detection accuracy of the power Internet of Things caused by incomplete consideration of factors during network security detection of the power Internet of Things in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of smart grids, and in particular to a network security detection method, device and electronic equipment for an electric power Internet of Things. Background Art

[0002] With the further construction of the new power system, its power structure, load characteristics, and network architecture have undergone significant changes. The traditionally relatively closed power Internet of Things needs to be opened in an orderly manner to support the diversified collaborative business needs of "source-grid-load-storage" with the increasing proportion of new energy. This transformation means that the new power system will cover a wider range of data collection and control, with more frequent business interactions, stricter requirements for real-time performance, more diversified means of controlling power and load, and provide more diversified services to the outside world.

[0003] Traditional security perception and improvement strategies are difficult to meet the needs of the rapid development of information and communication technologies in new power systems due to the high construction, upgrade and operation and maintenance costs, as well as poor scalability. With the evolution of new power services, the power Internet of Things has emerged. Information and communication infrastructure needs to support interactive collaboration from source to network, load to storage, as well as the synchronous operation of multi-subject power markets. This has led to a significant expansion of security boundaries and protection scopes, increasing security protection issues for data generalization, and significantly increased risks of unknown abnormal access. Due to the incomplete consideration of factors in the network security detection of the power Internet of Things in related technologies, the network security detection methods of the power Internet of Things in related technologies are less applicable to increasingly complex power systems, which in turn leads to low accuracy in network security detection of the power Internet of Things.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a network security detection method, device and electronic device for an electric power Internet of Things, so as to at least solve the technical problem in the related art that incomplete factors are considered when performing network security detection of the electric power Internet of Things, resulting in low accuracy of network security detection of the electric power Internet of Things.

[0006] According to one aspect of an embodiment of the present invention, a network security detection method for an electric power Internet of Things is provided, comprising: obtaining data packets corresponding to a plurality of electric power Internet of Things devices in the electric power Internet of Things in a current sampling period, and obtaining a plurality of initial data packets; determining a plurality of target data packets from the plurality of initial data packets based on a predetermined matching rule, and determining first abnormality identification results corresponding to the plurality of target data packets, respectively, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal feature of the data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets; constructing a target network traffic distribution diagram based on the plurality of target data packets, wherein the target network traffic distribution diagram is used to indicate the network traffic interaction relationship between the plurality of electric power Internet of Things devices in the current sampling period; determining second abnormality identification results corresponding to the plurality of target data packets, respectively, based on the target network traffic distribution diagram; determining a network security detection result of the electric power Internet of Things in the current sampling period based on the first abnormality identification results corresponding to the plurality of target data packets, respectively, and the second abnormality identification results corresponding to the plurality of target data packets, respectively, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the electric power Internet of Things.

[0007] According to another aspect of an embodiment of the present invention, a network security detection device for an electric power Internet of Things is also provided, comprising: an acquisition module, used to acquire data packets corresponding to a plurality of electric power Internet of Things devices in the electric power Internet of Things in a current sampling period, and obtain a plurality of initial data packets; a first determination module, used to determine a plurality of target data packets from the plurality of initial data packets based on a predetermined matching rule, and determine a first abnormality identification result corresponding to the plurality of target data packets, respectively, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal feature of the data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets; a first construction module, used to construct a target network traffic distribution diagram based on the plurality of target data packets, wherein the target network traffic distribution diagram is used to indicate the network traffic interaction relationship between the plurality of electric power Internet of Things devices in the current sampling period; a second determination module, used to determine a second abnormality identification result corresponding to the plurality of target data packets based on the target network traffic distribution diagram; a third determination module, used to determine a network security detection result of the electric power Internet of Things in the current sampling period based on the first abnormality identification results corresponding to the plurality of target data packets, respectively, and the second abnormality identification results corresponding to the plurality of target data packets, respectively, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the electric power Internet of Things.

[0008] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing any one of the network security detection methods for the electric power Internet of Things.

[0009] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the network security detection methods for the electric power Internet of Things.

[0010] In an embodiment of the present invention, a plurality of initial data packets are obtained by acquiring data packets corresponding to a plurality of power Internet of Things devices in the power Internet of Things in the current sampling period; a plurality of target data packets are determined from the plurality of initial data packets based on a predetermined matching rule, and first abnormality identification results corresponding to the plurality of target data packets are determined, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal feature of the data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets; a target network traffic distribution diagram is constructed based on the plurality of target data packets, wherein the target network traffic distribution diagram is used to indicate the network traffic interaction relationship between the plurality of power Internet of Things devices in the current sampling period; the plurality of target data packets are determined based on the target network traffic distribution diagram. The second abnormal identification results corresponding to the packets respectively; based on the first abnormal identification results corresponding to the multiple target data packets respectively, and the second abnormal identification results corresponding to the multiple target data packets respectively, the network security detection result of the electric power Internet of Things in the current sampling period is determined, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the electric power Internet of Things, thereby achieving the purpose of comprehensively determining whether there are network security risks in the electric power Internet of Things from two dimensions constructed from rule matching and network traffic distribution diagram, thereby achieving the technical effect of improving the comprehensiveness and security of network security detection of the electric power Internet of Things, and further solving the technical problem of low accuracy of network security detection of the electric power Internet of Things due to incomplete consideration of factors when conducting network security detection of the electric power Internet of Things in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0012] Figure 1 is a flow chart of a network security detection method of a power Internet of Things according to an embodiment of the present invention;

[0013] Figure 2 It is a flow chart of an optional network security detection method of the power Internet of Things according to an embodiment of the present invention;

[0014] Figure 3 is a schematic diagram of an optional system architecture according to an embodiment of the present invention;

[0015] Figure 4 It is a schematic diagram of a network security detection device of an electric power Internet of Things according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0017] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0018] First, to facilitate understanding of the embodiments of the present invention, some terms or nouns involved in the present invention are explained below:

[0019] DS evidence theory, also known as belief function theory, is a mathematical tool for processing uncertain information. Its core lies in belief assignment (Belief Functions), that is, given a set of evidence, belief assignment allows beliefs to be assigned to various combinations of a set of possible events rather than a single event, which enables it to express richer uncertainty information. In addition, when there are multiple sources providing evidence on the same issue, DS theory provides a method called Dempster's Rule to merge these evidences and obtain a comprehensive belief assignment. Exponentially weighted DS evidence theory extends the traditional DS theory and introduces an exponential weighting mechanism to handle evidence synthesis. In this framework, evidence from different sources is given different weights during the synthesis process according to its reliability or importance.

[0020] With the further construction of the new power system, its power structure, load characteristics, and network architecture have undergone significant changes. The traditionally relatively closed power Internet of Things needs to be opened in an orderly manner to support the diversified collaborative business needs of "source-grid-load-storage" with the increasing proportion of new energy. This transformation means that the new power system will cover a wider range of data collection and control, with more frequent business interactions, stricter requirements for real-time performance, more diversified means of controlling power and load, and provide more diversified services to the outside world.

[0021] Traditional security perception and improvement strategies are difficult to meet the needs of the rapid development of information and communication technologies in new power systems due to the high construction, upgrade and operation and maintenance costs, as well as poor scalability. With the evolution of new power services, information and communication infrastructure needs to support interactive collaboration from source to network, load to storage, as well as the synchronous operation of multi-subject power markets. This has led to a significant expansion of security boundaries and protection scopes, increasing security protection issues for data generalization, and significantly increased risks of unknown abnormal access. How to achieve efficient network security situational awareness under the premise of cross-domain circulation of massive data has become an urgent problem to be solved.

[0022] The existing technical scheme 1 comprises a data preprocessing module (1), an attack feature library construction module (2), an attack status identification module (3), a security situation assessment module (4) and a security situation prediction module (5), wherein: the data preprocessing module (1) is used to collect data sets from different sources and extract the main component information used for network security situation awareness, and then perform data association analysis to eliminate the redundancy of multi-source data and mine the association between the data, thereby obtaining the vulnerability information, attack information and asset information required for network security situation calculation, and obtaining the corresponding asset vulnerability threat data and asset attack threat data; the attack feature library construction module (2) is used to analyze the asset attack threat data generated by the association analysis, and extract the main component information used for network security situation awareness. The main component data of the data and attack information are further analyzed and trained to establish an attack feature library; an attack state identification module (3) is used to match the pre-processed data with the attack portrait in the attack feature library, identify the current attack mode, and then determine the attack state of the current device by comparing it with the attack state diagram; a security situation assessment module (4) is used to evaluate the importance of the network device in the network, calculate the risk value of the network device, and evaluate the security situation of the entire network based on the asset vulnerability threat data and asset attack threat data obtained by the data pre-processing module (1); a security situation prediction module (5) is used to predict the next attack state through the attack and defense game matrix of the attack state diagram, thereby realizing the prediction of the network security situation. However, this method relies on general computing devices, such as servers or cloud computing resources, to process data and execute algorithms, resulting in processing speed limited by the performance of the central processing unit (CPU) or the graphics processing unit (GPU), as well as network delay. In particular, in large-scale data processing and real-time analysis, there are defects in processing speed and real-time performance.

[0023] Existing technical solution 2 provides a network security monitoring method based on situational awareness, and the steps mainly include the following aspects: Collecting raw data: This step involves collecting raw data related to network security, mainly including security situation data and security event data. Security situation data refers to data that may affect the occurrence of security events, while security event data refers to data collected when security events occur. Data preprocessing and aggregation analysis: Combined with security event data, the collected security situation data is preprocessed and aggregated. The purpose of this step is to extract the characteristic values ​​of security situation data in preparation for subsequent classification and evaluation. Feature value extraction: The sample IP is extracted from each security event data through the sample IP extraction algorithm. Then, the RIR database is queried for each sample IP to obtain all IP address blocks related to the sample IP, and the sample IP and its corresponding IP address block are used as an aggregation unit. Aggregate data calculation: Aggregate each aggregation unit with the security situation data, calculate the ratio of difference data and malicious data hitting the IP address block contained in the aggregation unit, and obtain the characteristic value. Training random forest model: The extracted characteristic value is input into the preset random forest model for training. This model calculates the Gini coefficient value corresponding to each eigenvalue, and determines the target decision tree based on these values, thereby obtaining the target classification corresponding to the eigenvalue. Security assessment: Based on the target classification and the preset event conditions, the security assessment results are obtained. This step involves judging the security of the current network and taking corresponding treatment measures based on the evaluation results. However, although random forest is a powerful machine learning model, it may not be suitable for all types of network security issues. The accuracy and reliability of the model depend on the quality of the training data and the appropriateness of the feature selection. If the training data is biased or insufficient, it may lead to inaccurate monitoring results. In addition, the method in the patent focuses on monitoring based on known security event data, and may have limited detection capabilities for emerging unknown threats (Zero-day attacks). Unknown threats are a major challenge in the field of network security, and detection methods need to be continuously updated and improved.

[0024] Existing technical solution 3 provides a network security situation awareness method based on knowledge graph, which mainly includes the following steps: Constructing a security situation awareness model: Constructing a model for network security situation awareness based on knowledge graph. This model uses network data to determine the network security knowledge graph, thereby providing a basis for subsequent network attack scenario identification and situation value determination. Identifying network attack scenarios: Using the constructed security situation awareness model to identify attack scenarios in the network. These attack scenarios can be divided into single-step attack scenarios and multi-step attack serial scenarios. Single-step attack scenarios are identified by alarm aggregation, while multi-step attack serial scenarios are identified by alarm correlation analysis. Alarm correlation analysis: When identifying multi-step attack serial scenarios, alarm correlation analysis is required. This includes mining potential multi-step attacks to determine correlation metrics, which include time correlation metrics, spatial correlation metrics, and service correlation metrics. These metrics are used to analyze the correlation between attack events. Setting an attack threshold: On the basis of alarm correlation analysis, an attack threshold is set. By judging whether the correlation metrics between attack events exceed this threshold, it is determined whether they belong to the same multi-step attack serial scenario. Determine the situation value of network assets: Determine the situation value of network assets based on the identified network attack scenarios to perceive the overall situation of network security. However, this method faces adjustments in the challenge of processing large-scale data. As the scale of the network expands, processing and analyzing large-scale data sets requires a lot of computing resources and storage capabilities, which may affect the performance and response time of the host machine, especially in real-time monitoring and early warning. At the same time, the complexity and dynamics of the network environment may make it more difficult to identify attack scenarios. Newly emerging attack methods and vulnerabilities may not be immediately covered by the knowledge graph, and the method is time-sensitive.

[0025] Based on the above problems, an embodiment of the present invention provides a method embodiment of network security detection of an electric power Internet of Things. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0026] Figure 1 is a flow chart of a network security detection method of the power Internet of Things according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0027] Step S102, obtaining data packets corresponding to a plurality of power Internet of Things devices in the power Internet of Things in the current sampling period, and obtaining a plurality of initial data packets;

[0028] Optionally, the execution entity of steps S102 to S110 can be a data processing unit (DPU) set on the edge server in the power Internet of Things, and the CPU is provided with a field programmable gate array (FPGA) and a CPU for executing the corresponding steps in steps S102 to S110.

[0029] Among them, the FPGA and CPU can be connected using Peripheral Component Interconnect Express (PCle). An optical fiber and a network cable need to be connected to the DPU. The optical fiber is connected to the business network switch to carry business traffic, and the network cable is connected to the management network switch to manage and control the DPU. The host machine uses the DPU's virtual interface for network communication to achieve complete and secure isolation.

[0030] Optionally, the multiple power IoT devices in the power IoT may include, but are not limited to, smart meters, distribution automation terminals, phasor measurement units, relay protection devices, distribution network sensing devices, environmental monitoring devices, etc. Each power IoT device accesses data to the edge server through a network interface. Each power IoT device sends the collected data in the form of data packets to the FPGA in the edge server, and the FPGA uses the multiple initial data packets received from the multiple power IoT devices for subsequent data processing.

[0031] Step S104, based on a predetermined matching rule, determining a plurality of target data packets from the plurality of initial data packets, and determining first abnormality identification results respectively corresponding to the plurality of target data packets, wherein the predetermined matching rule is used to indicate a corresponding relationship between an abnormal access type and an abnormal feature of a data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets;

[0032] Optionally, the predetermined matching rule can be understood as a rule for detecting anomalies in data packets from edge IoT devices. Through the predetermined matching rule, data packets with anomalies can be preliminarily screened out from multiple received initial data packets to obtain multiple target data packets. It can be understood that by matching multiple initial data packets with predetermined rules, it is possible to identify whether there are data packets in the multiple initial data packets that hit the corresponding abnormal access type, and abnormal network access can be discovered and responded to in a timely manner, which helps to protect network data and system security.

[0033] In an optional embodiment, based on a predetermined matching rule, multiple target data packets are determined from multiple initial data packets, and first abnormality identification results corresponding to the multiple target data packets are determined, including: obtaining header information corresponding to the multiple initial data packets, wherein the header information is metadata for transmission and routing included in the corresponding initial data packet; based on the header information, multiple first data packets are determined from the multiple initial data packets, wherein the number of the multiple first data packets is less than the number of the multiple initial data packets; based on the port information corresponding to the multiple initial data packets, multiple second data packets are determined from the multiple initial data packets, wherein the number of the multiple second data packets is less than the number of the multiple initial data packets; based on the multiple first data packets and the multiple second data packets, and based on the predetermined matching rule, first abnormality identification results corresponding to the multiple target data packets are determined, wherein the number of the multiple target data packets is less than the number of the multiple first data packets, and the port information is used to indicate the port identifier of the corresponding first data packet on the corresponding power Internet of Things device.

[0034] Optionally, the header information of a data packet (i.e., the header field) refers to the metadata contained in the data packet for transmission and routing, and is located at the beginning of the data packet. The header information contains control information and metadata that describes the data packet, such as source address, destination address, protocol type, packet length, checksum, tag and priority, timestamp, version number, etc. The header information is used to control the transmission, routing, and processing of data packets to ensure that the data packets can reach the destination correctly. Port information refers to the port number of the data packet on the network device, which is used to identify the import and export of the data packet. The header information of the data packet can contain information about the source port and destination port to help determine the source and destination of the data packet.

[0035] In the above method, firstly, it is determined whether there are abnormal data packets in the multiple initial data by checking the header information, and multiple first data packets are obtained; on this basis, the multiple initial data packets received are further screened by port information to determine whether there are abnormal data packets, and multiple second data packets are obtained; the multiple first data packets and the multiple second data packets are taken as a union, and the obtained data packets are used as multiple target data packets, and the multiple target data packets are data packets that may contain abnormalities. In the above method, the data packets are screened from two dimensions of header information and port information to obtain multiple target data packets that meet the corresponding conditions. By obtaining the header information and port information, and combining with the predetermined matching rules, the target data packet can be determined more accurately, which helps to improve the accuracy of identifying abnormal access types.

[0036] Optionally, for each of the multiple initial data packets, a selected string (called a quick pattern) and a header field of a rule can be checked first, and only data packets that match both the header field and the quick pattern are handed over to the regular expression matching module for processing. The quick pattern string matching module and the port matching module are implemented, thereby reducing the data packets that need to be processed later, thereby reducing the hardware resource requirements.

[0037] In an optional embodiment, determining first abnormality identification results respectively corresponding to multiple target data packets includes: based on a predetermined matching rule, determining abnormality identification rules respectively hit by the multiple target data packets; based on regular expressions corresponding to the abnormality identification rules respectively hit by the multiple target data packets, detecting whether the multiple target data packets hit the corresponding abnormality identification rules, and obtaining first abnormality identification results respectively corresponding to the multiple target data packets.

[0038] Optionally, the anomaly identification rule hit by the target data packet can be determined according to a predetermined matching rule, and the target data packet is detected by a regular expression to determine whether it meets the anomaly identification rule, thereby obtaining an anomaly identification result of the target data packet. In the above manner, by hitting the anomaly identification rule and applying the regular expression for detection, the abnormal data packet can be identified more accurately, which helps to timely discover and respond to potential network security issues.

[0039] Optionally, after receiving multiple initial data packets, the FPGA can first filter the normal traffic (i.e., normal data packets) of the multiple initial data packets through the header information and port information, and directly forward them. A small number of data packets (i.e., the filtered multiple target data packets) are matched with regular expressions based on predetermined matching rules, and full matching is performed on data packets that may have abnormalities, and corresponding data packet processing actions are performed according to the matching results. The data packets will first perform fast mode string matching, and then perform header matching, thereby filtering most of the completely harmless data packets. Finally, only the suspicious data packets among the multiple initial data packets are sent to the regular expression matching module for full matching.

[0040] Step S106, constructing a target network traffic distribution map based on the multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between the multiple power IoT devices in the current sampling period;

[0041] Optionally, a target network traffic distribution map that can characterize the network traffic interaction relationship between multiple power Internet of Things devices is constructed based on multiple target data packets. The target network traffic distribution map uses multiple power Internet of Things devices as nodes and the size of the network traffic between multiple power Internet of Things devices as the weight of the edge, which can effectively characterize the network traffic interaction relationship between multiple power Internet of Things devices.

[0042] It should be noted that, since deploying all regular expression rules directly on the FPGA will consume a lot of resources, a hybrid solution can be selected, that is, the regular expression matching process is completed by the FPGA and software. The software layer is not only responsible for performing part of the matching task, but also has the ability to update the FPGA cache rules and guide the automaton structure in the FPGA to dynamically reconfigure the rules. This design effectively balances the needs of resource usage and system flexibility. Specifically, by analyzing the header information of each initial data packet and using the fast matching string of the content field (i.e., the "content" field) in all rules, each character in the initial data packet is screened. In order to reduce the probability of false positives, the super character and hash table scheme in the multi-string matching algorithm can be used. Then, the port information of the data packet can be further verified, and this operation can further exclude the wrongly matched data packets. Finally, the metadata of the data packet and the triggered rule identifier are output, and the regular expression matching of the corresponding rule ID is applied to the data packets screened by the above operation. In fact, only a very small number of data packets need to be thoroughly checked for regular expression matching.

[0043] Optionally, the arbiter module in the FPGA can also perform diversion on multiple initial data packets according to the incoming hit rule ID. There are three possible processing paths after the data packet is diverted. The first is the data packet that does not hit any rule, which will be forwarded directly. The second is the data packet whose hit rules are all implemented in the software, which will be sent to the CPU for software processing. The remaining data packets will be sent to the FPGA in batches according to the time window for regular expression matching. In order to ensure that all data packets that may have abnormalities are checked, when the number of rules hit by the data packet sent to the FPGA exceeds the number of automaton frames preset in the FPGA, the subsequent data packets will be sent to the CPU for full matching. For data packets that need to be processed by the FPGA within a time window, there are two possible types. One is that all hit rules have been cached in the FPGA and there is no cache conflict. Then the arbiter module will directly send a rule reconfiguration instruction. The other is that only some hit rules are in the FPGA cache, while other hit rules are in the software, or the hit rules are in the FPGA cache but there is a cache conflict. The Arbiter module will first send the rule ID that needs to be implemented in the FPGA to the software to execute the unloading plan, and then send the rule data that needs to be unloaded in the current time window through the Quick Data Movement Accelerator (QDMA), update the rule cache data required for the current time window, and after completion, send the automatic machine reconfiguration instruction through the Arbiter module.

[0044] In an optional embodiment, a target network traffic distribution map is constructed based on multiple target data packets, including: parsing and processing the multiple target data packets respectively to obtain source addresses, destination addresses, network traffic and network traffic characteristics corresponding to the multiple target data packets respectively; based on the source addresses, destination addresses, network traffic and network traffic characteristics corresponding to the multiple target data packets respectively, a target network traffic distribution map is constructed with multiple target data packets as nodes, directed line segments from source addresses to destination addresses as edges, network traffic as edge weights, and network traffic characteristics as node characteristics.

[0045] Optionally, the construction of the target network traffic distribution map can be completed in the CPU, with the IP address of each power IoT device as the node, and the size of the network flow between two nodes, namely the IP address (i.e., the source address and the destination address) as the weight of the edge, to construct the target network traffic distribution map. Specifically, by parsing and processing the target data packet, extracting the source address, destination address, network traffic and characteristic information, and then constructing the target network traffic distribution map based on this information. The target network traffic distribution map can be used to analyze network traffic patterns, network traffic characteristics and traffic distribution, to help network administrators better understand the data flow in the network, identify abnormal situations, optimize network performance, etc. By constructing the target network traffic distribution map, the traffic relationship and characteristics between different data packets can be intuitively displayed, helping to better understand the network traffic situation. By analyzing the target network traffic distribution map, abnormal traffic patterns or abnormal data packets can be quickly identified, which helps to promptly discover and solve network problems.

[0046] Step S108, determining second anomaly identification results corresponding to a plurality of target data packets respectively based on the target network traffic distribution diagram;

[0047] It can be understood that the target network traffic distribution map can show the traffic relationship and characteristics between different data packets. By analyzing the target network traffic distribution map, abnormal traffic patterns or abnormal data packets can be more accurately identified, which helps to timely discover potential network security issues. The second abnormal identification result obtained by analysis can be used as the basis for abnormal identification of each target data packet.

[0048] Optionally, it is possible but not limited to determining the second anomaly recognition results corresponding to multiple target data packets respectively based on the target network traffic distribution graph and using a graph convolution neural network (GCN) as a decision engine.

[0049] In an optional embodiment, based on the target network traffic distribution map, second anomaly identification results corresponding to multiple target data packets are determined, including: based on the target network traffic distribution map, a pre-trained classification model is used to obtain second anomaly identification results corresponding to multiple target data packets, wherein the second anomaly identification results are used to indicate the anomaly probability of the corresponding target data packet, and the abnormal access type corresponding to the target data packet; the classification model is based on the network traffic distribution map obtained by the power Internet of Things in multiple historical sampling periods, and the anomaly identification results corresponding to the data packets included in the corresponding network traffic distribution map, and is trained using a graph convolutional neural network algorithm.

[0050] It can be understood that by adopting a pre-trained classification model, it is possible to achieve rapid and automated anomaly identification of target data packets and improve processing efficiency. Using a graph convolutional neural network algorithm to train a classification model can make full use of information from historical data to improve the accuracy and generalization of anomaly identification. Through this classification model, a second anomaly identification result including anomaly probability and identification of abnormal access types can be predicted, which can achieve real-time monitoring and response, help timely discover and solve network anomaly problems, and provide a basis for network security detection of the power Internet of Things.

[0051] This embodiment uses the GCN graph convolutional neural network, which has two significant advantages over CNN: 1) Fully utilize the connections between nodes; GCN can effectively utilize the neighbor relationships between nodes. By passing messages in the network, each node can aggregate information from neighbor nodes and update its own representation. 2) Fully consider the global structure of the graph; GCN can capture the global structural information of the entire graph. Through multiple iterations, GCN can transmit and integrate information, so that each node can comprehensively consider the characteristics of the entire graph.

[0052] In order to deeply analyze the interactive characteristics of network traffic and reveal its potential communication mode, this embodiment converts the original network traffic data (i.e., multiple target data packets) into structured network flows. By deeply parsing the network packet capture file (PCAP) corresponding to each data packet, not only can the key information of network communication be extracted, but also a series of detailed communication network flow data can be constructed. Then, the timestamp of each flow is calibrated, and a time window mechanism is established. According to the set window size, the network flow and its mutual correlation are effectively extracted, and then the interactive map of network traffic (i.e., multiple target data packets) is drawn in each time window, thereby providing a new perspective for a comprehensive understanding of network traffic behavior.

[0053] In order to deeply analyze the interactive characteristics of network traffic and reveal its potential communication mode, the embodiment of the present invention converts the original network traffic data (i.e., multiple target data packets) into a structured network flow. By deeply parsing the network packet capture file (PCAP) corresponding to each data packet, not only can the key information of network communication be extracted, but also a series of detailed communication network flow data can be constructed. Then, the timestamp of each flow is calibrated, and a time window mechanism is established. According to the set window size, the network flow and its mutual correlation are effectively extracted, and then the interactive map of the network traffic (i.e., multiple target data packets) is drawn in each time window, thereby providing a new perspective for a comprehensive understanding of network traffic behavior.

[0054] For the construction of the graph structure (network traffic distribution graph), the communication topology in the time interval is mapped into a directed graph. Each node in the graph is regarded as an IP address, and the source IP address points to the target IP address. The size of the network flow between the two nodes, i.e., the IP address, is used as the weight of the edge. The node features are obtained through the potential data features of the graph structure. In this processing method, the network location information of the node and its relationship with other nodes can be effectively converted into a set of numerical representations, thereby providing a unique and information-rich vector representation for each IP address. These vectors can then be used for a variety of machine learning tasks, including but not limited to node classification, anomaly detection, and pattern recognition.

[0055] In the network layer, the network flow contains a five-tuple {SIP, srcpkts, TIP, tgtpkts, protocol}, where SIP is the source host IP of the flow, srcpkts is the number of packets from SIP to TIP, TIP is the destination host IP of the flow, tgtpkts is the number of packets from TIP to SIP, and protocol represents the communication protocol. The graph structure G constructed in period t t =(V t ,E t ), where V and E represent the node set and edge set of the graph respectively, V t = {V SIP ,V TIP} t , e ij =SIP i →TIP j is a directed edge. ij The weight of |e ij |=srcpkts, edge e ji The weight of |e ji|=tgtpkts. As for node characteristics, degree is used here to measure. Degree is a key indicator to measure the host behavior characteristics. Since the constructed network graph is weighted, the degree can be divided into weighted degree and unweighted degree. The definitions of unweighted in-degree (ID) and unweighted out-degree (OD) are as follows:

[0056]

[0057] in, represents the unweighted in-degree corresponding to the i-th node in the node set, represents the unweighted out-degree corresponding to the i-th node in the node set; the in-degree represents the number of edges pointing to the i-th node, and the out-degree represents the number of edges flowing out of the i-th node; v i represents the i-th node in the node set, v j Represents the jth node in the node set, and the jth node is the other nodes in the node set except the i-th node.

[0058] The definitions of In Degree Weighted (IDW) and Out Degree Weighted (ODW) are as follows:

[0059]

[0060] in, Indicates the weighted in-degree corresponding to the i-th node in the node set, Represents the weighted out-degree corresponding to the i-th node in the node set.

[0061] The non-weighted degree reflects the total number of other hosts communicating with a specific host node, while the weighted degree is an in-depth supplement to this non-weighted degree, providing more detailed information. The weighted degree is achieved by considering the magnitude of communication, where the in-degree weight (IDW) represents the total amount of data packets sent by a node, and the out-degree weight (ODW) represents the total amount of data packets received by a node. Typically, the in-degree (ID) of the host node that initiates abnormal access will be higher than that of a normal host, although a high in-degree node does not always mean that it is abnormal. Out-degree (OD) is also an important dimension when analyzing network behavior. Therefore, the data of the in-degree, out-degree, in-degree weight and out-degree weight of the node are summarized and can be used as a basic graphical feature set for evaluating the behavior of the host node. Through the above analysis, this embodiment selects ID, OD, IDW, and ODW information as node features.

[0062] After the graph structure is constructed, the decision engine uses a graph convolutional neural network for multi-classification tasks. The GCN model used includes three main parts, namely the convolution layer, the output layer, and the loss function. Among them:

[0063] For the convolution layer: In each convolution layer, the feature representation of the node will be affected by the information of its neighboring nodes. Through multi-layer convolution, deep representation learning of node features can be achieved.

[0064]

[0065] Among them, H (l+1) represents the feature matrix of the l+1th layer node, H (l) represents the feature matrix of the l-th layer node, is the new adjacency matrix obtained by adding the identity matrix I to the adjacency matrix A. The diagonal elements are The degree matrix, W (l) is the weight matrix of the lth layer, σ is the activation function, and the sigmoid function is used here. It can be seen that each layer of GCN aggregates node features through the adjacency matrix and degree matrix, and shares weights to reduce the number of parameters. By stacking multiple layers of GCN, the features of the nodes can be iterated multiple times to obtain richer information.

[0066] For the output layer: Softmax is used as the classification function of the output layer, which maps the input to a range of (0,1) so that it can be interpreted as the probability of a certain class. The Softmax function is as follows.

[0067]

[0068] Among them, P i represents the probability of a certain class, Y i is the i-th node of the output, N is the total number of output nodes, P i Represents the predicted probability of the i-th node.

[0069] For the loss function: cross entropy loss is used to measure the correctness of the model prediction, as shown in the following formula.

[0070]

[0071] Among them, Loss represents the loss function value, K is the number of categories, and p ic represents the probability that the observed node i belongs to category c, y ic is a sign function (takes 0 or 1), if the true category of sample i is c, it takes 1, otherwise it takes 0.

[0072] Step S110, based on the first abnormal identification results corresponding to multiple target data packets, and the second abnormal identification results corresponding to multiple target data packets, determine the network security detection result of the power Internet of Things in the current sampling period, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

[0073] It should be noted that, since the rule-matching-based deep packet inspection focuses on the internal information of network traffic and seriously ignores the external connection of network traffic, although it has good performance in the inherent abnormal access type traffic detection, it cannot cope with the new abnormal access detection in complex network scenarios as the network scale continues to expand. In the scenario of the power Internet of Things constructed by the new power system, abnormal network access is often not initiated by a single node, but from multiple different distributed nodes working together, mixing into normal traffic in a low-speed and covert way. If only deep packet inspection is used to mine abnormal traffic, some seemingly "normal" traffic may be missed, and the macro nature of comprehensive defense will be lost. Based on this, the first abnormal identification results corresponding to the multiple target data packets obtained by rule matching are combined with the second abnormal identification results obtained by constructing and identifying the target network traffic distribution map, and the network security detection results of the power Internet of Things are determined comprehensively, so as to timely and accurately identify whether there is abnormal access data in the process of data interaction between the various power Internet of Things devices in the power Internet of Things during the current sampling period.

[0074] In an optional embodiment, based on first abnormality identification results corresponding to multiple target data packets, and second abnormality identification results corresponding to multiple target data packets, determining the network security detection results of the power Internet of Things in the current sampling period, including: converting the first abnormality identification results corresponding to the multiple target data packets into a first trust distribution, and obtaining the first trust distributions corresponding to the multiple target data packets, wherein the first trust distribution is used to indicate the degree of trust in the first abnormality identification result; converting the second abnormality identification results corresponding to the multiple target data packets into a second trust distribution, and obtaining the second trust distributions corresponding to the multiple target data packets, wherein the second trust distribution is used to indicate the degree of trust in the second abnormality identification result; determining the first index weights corresponding to the multiple target data packets, and the second index weights corresponding to the multiple target data packets; based on the first trust distribution, the first index weight, the second trust distribution and the second index weight corresponding to the multiple target data packets, obtaining the target abnormality identification results corresponding to the multiple target data packets; based on the target abnormality identification results corresponding to the multiple target data packets, determining the network security detection results of the power Internet of Things in the current sampling period.

[0075] Optionally, the first abnormal identification result and the second abnormal identification result of each target data packet are converted into a corresponding trust distribution to indicate the degree of trust in the corresponding abnormal identification result. The first abnormal identification result and the second abnormal identification result are combined with the corresponding index weights, and the credibility and importance of different abnormal identification results are comprehensively considered to improve the accuracy and reliability of abnormal detection of each target data packet. By performing weighted calculations on the first trust distribution, the first index weight, the second trust distribution, and the second index weight corresponding to the target data packets, the target abnormal identification result of each target data packet can be obtained. Through the application of trust distribution and index weight, the degree of trust and weight of the abnormal identification result can be quantified. The target abnormal identification result obtained on this basis can more accurately determine the abnormal state of each target data packet. On this basis, based on the target abnormal identification result of each target data packet, the network security detection result of the power Internet of Things determined is also more accurate and reliable.

[0076] Optionally, it is possible but not limited to the DS evidence theory based on the exponentially weighted belief function, by fusing the first anomaly identification result of each target data packet obtained based on rule matching and the second anomaly identification result of each target data packet obtained based on GCN decision, to achieve complementary advantages between different factors, weaken the uncertainty component existing in the fusion factor, and obtain an effective fusion result as the target anomaly identification result corresponding to each target data packet. Thereby having the comprehensive judgment ability of various new abnormal accesses. The above method can fully explore and utilize the information obtained from network monitoring, combine the comprehensive judgment from the macro and micro perspectives, and provide managers with an accurate and comprehensive abnormal access identification solution. In the DS evidence theory, let the basic probability distribution function be p, p(Q) is the basic credibility of proposition Q, a represents the abnormal access type, b represents the source of evidence, and p v (Q a )(v=1,2,…,b) represents the probability that the vth decision engine points to the ath attack. a,v (v=1,2,…,b) is the exponential weight of the ath abnormal access type in the vth one.

[0077]

[0078] Among them, δ represents the conflict coefficient, m represents the number of abnormal access types, It means that the gradient descent algorithm is used to optimize the exponential weight in the evidence theory so that the objective function loss is minimized. The objective function is:

[0079]

[0080] The weight update formula is as follows:

[0081]

[0082] Among them, y a The real label value of the packet for the ath anomaly access.

[0083] In an optional embodiment, based on the target anomaly identification results corresponding to multiple target data packets, the network security detection result of the electric power Internet of Things in the current sampling period is determined, including: determining the total network traffic in the electric power Internet of Things in the current sampling period; determining the multiple abnormal access types detected in the electric power Internet of Things in the current sampling period, and the abnormal traffic in the electric power Internet of Things in the current sampling period based on the target anomaly identification results corresponding to multiple target data packets; determining the weight values ​​corresponding to the multiple abnormal access types, and the duration corresponding to the multiple abnormal access types; determining the normal traffic in the electric power Internet of Things in the current sampling period based on the total network traffic and the abnormal traffic; determining the network security detection result based on the total network traffic, normal traffic, the weight values ​​corresponding to the multiple abnormal access types, and the duration corresponding to the multiple abnormal access types.

[0084] Optionally, in view of the subjective characteristics of the Analytic Hierarchy Process (AHP) and the objective properties of the entropy weight of the entropy weight method using information entropy to calculate the index, a game theory comprehensive weight calculation method can be used to determine the impact weight of each abnormal access type, so as to adapt to the difference in standard values ​​under the digital power grid.

[0085] First, the weights W1 and W2 of each abnormal access type are calculated using the hierarchical analysis method and entropy weight method. Then, the two weight values ​​are linearly processed to obtain the comprehensive weight W S As the impact weights corresponding to each abnormal access type, μ1 and μ2 are both combination coefficients.

[0086] W S =μ1W1+μ2W2

[0087]

[0088] Among them, μ e is one of μ1 and μ2, W e is one of W1 and W2 and μ e The corresponding weight, W f Divide W by W1 and W2 e Then set the objective function to optimize the combined coefficients, thereby reducing the deviation between the weights W1 and W2 of each indicator.

[0089] Optionally, the network security detection score can be determined based on the total network traffic, normal traffic, weight values ​​corresponding to various abnormal access types, and durations corresponding to various abnormal access types:

[0090]

[0091] Where Ass represents the detection score, M is the total network traffic in the time window (i.e., the current sampling period), m is the normal traffic in the time window, n is the total number of abnormal access types that occur in the time period, and t i Indicates the duration of any abnormal access type. Indicates the weight value of the abnormal access type.

[0092] Optionally, based on the detection score Ass, the security level of the power Internet of Things in the current sampling period can be determined, and the security level can be used as the network security detection result of the power Internet of Things in the current sampling period, wherein the correspondence between the detection score Ass and the security level is shown in Table 1 below.

[0093] Table 1

[0094]

[0095] Through the above-mentioned steps S102 to S110, the purpose of comprehensively determining whether there are network security risks in the power Internet of Things can be achieved by constructing two dimensions from rule matching and network traffic distribution diagram, thereby achieving the technical effect of improving the comprehensiveness and security of network security detection of the power Internet of Things, and further solving the technical problem of low accuracy of network security detection of the power Internet of Things due to incomplete consideration of factors when conducting network security detection of the power Internet of Things in related technologies.

[0096] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation mode: Figure 2 is a flowchart of an optional network security detection method for the power Internet of Things according to an embodiment of the present invention. Figure 3 is a schematic diagram of an optional system architecture according to an embodiment of the present invention, such as Figure 2 and Figure 3 As shown, the method includes:

[0097] System architecture construction: In the new power system, namely the power Internet of Things, a traffic extraction architecture based on the data processing unit (DPU) is constructed with integrated software and hardware collaboration. This architecture is deployed on the edge server, spanning the business traffic analysis layer and the terminal risk assessment layer, using the FPGA+CPU architecture and connected via PCIe. The DPU needs to be connected to the optical fiber line and the network cable, respectively connected to the business network switch and the host machine, to achieve complete isolation of security and comprehensiveness.

[0098] Power perception terminal layer deployment: Various power IoT devices are deployed at the power perception terminal layer, such as smart meters, distribution automation terminals, etc. Data access is achieved through the network interface to the MEC edge server as the starting point for security situation awareness.

[0099] Implementation of the service traffic analysis layer: The service traffic analysis layer is deployed on the MEC edge server, and the data packets are pre-filtered through the fast mode string matching module and the port matching module to reduce the number of data packets to be processed later. The regular expression matching engine performs a full match on suspicious data packets and performs corresponding data packet processing actions based on the results.

[0100] Terminal risk assessment layer development: The CPU on the DPU performs terminal risk assessment, uses the graph convolutional neural network (GCN) as a decision engine, mines the external connections of network traffic, and achieves global network perception. Multi-source fusion uses the exponential weighted fusion theory to combine the decision results output by the DPI engine and GCN to improve attack identification capabilities.

[0101] Integration of business security management and control layer: Deploy the DPU security management and control platform in the smart grid cloud service center to monitor the operation status of all DPUs and the terminal security situation assessment level, update the regular matching rule library on the FPGA, and realize secure operation and maintenance and dynamic management and control.

[0102] Packet processing and analysis: A multi-modal matching mechanism is used to complete the regular expression matching process through FPGA and software. The Arbiter module performs packet diversion according to the matching rule ID to ensure that all packets that may have anomalies are checked.

[0103] Graph model construction and feature extraction: After the DPU's FPGA implements deep parsing of data packets, the network flow graph model construction and feature extraction are completed in the CPU. GCN is used for multi-classification tasks, and the classification model of abnormal traffic is trained to determine the abnormal access type and probability of data.

[0104] Multi-source fusion and situation assessment: Using the exponentially weighted DS evidence theory, combined with the results of the GCN decision engine and the DPU module deep packet inspection, the advantages of different factors are complemented. The hierarchical analysis algorithm and the improved entropy weight method are used to calculate the impact weights of different types of attacks and comprehensively measure the security situation of the network.

[0105] Security situation level classification: Different security situation levels are classified according to the security situation assessment value, from safe state to emergency and extremely dangerous, to provide network managers with a macro-control strategy deployment method.

[0106] In the embodiment of the present invention, a deep packet inspection architecture based on software and hardware collaboration and integration based on a data processing unit (DPU) is proposed to release the computing power of the CPU to upper-layer applications, significantly improving the overall processing capability and throughput of the system. At the same time, a network security situation awareness model based on GCN fusion is designed, which uses a graph structure to characterize the interactive characteristics of complex network flows, and realizes global perception for the power Internet of Things scenario of the new power system, significantly enhancing the ability to accurately identify attack behaviors, and providing strong support for ensuring the security of the power Internet of Things.

[0107] In this embodiment, a network security detection device for an electric power Internet of Things is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the terms "module" and "device" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0108] According to an embodiment of the present invention, there is also provided an embodiment of a device for implementing the above-mentioned network security detection method of the electric power Internet of Things. Figure 4 is a structural schematic diagram of a network security detection device of a power Internet of Things according to an embodiment of the present invention, such as Figure 4 As shown, the network security detection device of the electric power Internet of Things includes: an acquisition module 400, a first determination module 402, a first construction module 404, a second determination module 406, and a third determination module 408, wherein:

[0109] An acquisition module 400 is used to acquire data packets corresponding to a plurality of power Internet of Things devices in the power Internet of Things in a current sampling period, and obtain a plurality of initial data packets;

[0110] A first determination module 402, connected to the acquisition module 400, is used to determine a plurality of target data packets from a plurality of initial data packets based on a predetermined matching rule, and determine first abnormality identification results respectively corresponding to the plurality of target data packets, wherein the predetermined matching rule is used to indicate a corresponding relationship between an abnormal access type and an abnormal feature of a data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets;

[0111] A first constructing module 404, connected to the first determining module 402, is used to construct a target network traffic distribution map based on multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between multiple power IoT devices in the current sampling period;

[0112] A second determination module 406, connected to the first construction module 404, is used to determine second anomaly identification results corresponding to a plurality of target data packets respectively based on the target network traffic distribution diagram;

[0113] The third determination module 408 is connected to the second determination module 406, and is used to determine the network security detection result of the power Internet of Things in the current sampling period based on the first abnormality identification results corresponding to the multiple target data packets and the second abnormality identification results corresponding to the multiple target data packets, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

[0114] In an embodiment of the present invention, an acquisition module 400 is set to acquire data packets corresponding to multiple power Internet of Things devices in the power Internet of Things during the current sampling period, and obtain multiple initial data packets; a first determination module 402 is connected to the acquisition module 400, and is used to determine multiple target data packets from the multiple initial data packets based on a predetermined matching rule, and determine the first abnormality identification results corresponding to the multiple target data packets, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal feature of the data packet, and the number of the multiple target data packets is less than the number of the multiple initial data packets; a first construction module 404 is connected to the first determination module 402, and is used to construct a target network traffic distribution map based on the multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between the multiple power Internet of Things devices during the current sampling period; a second determination module 406 is connected to the first construction module 404 is used to determine the second abnormality identification results corresponding to multiple target data packets respectively based on the target network traffic distribution map; the third determination module 408 is connected to the second determination module 406, and is used to determine the network security detection result of the electric power Internet of Things in the current sampling period based on the first abnormality identification results corresponding to the multiple target data packets respectively, and the second abnormality identification results corresponding to the multiple target data packets respectively. The network security detection result is used to indicate whether there is an abnormal access data packet in the electric power Internet of Things, which achieves the purpose of comprehensively determining whether there are network security risks in the electric power Internet of Things by constructing two dimensions from rule matching and network traffic distribution map, thereby achieving the technical effect of improving the comprehensiveness and security of network security detection of the electric power Internet of Things, and further solving the technical problem of low accuracy of network security detection of the electric power Internet of Things due to incomplete consideration of factors when conducting network security detection of the electric power Internet of Things in related technologies.

[0115] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0116] It should be noted that the acquisition module 400, the first determination module 402, the first construction module 404, the second determination module 406, and the third determination module 408 correspond to steps S102 to S110 in the embodiment, and the examples and application scenarios implemented by the modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the modules as part of the device can be run in a computer terminal.

[0117] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0118] The above-mentioned network security detection device of the power Internet of Things may also include a processor and a memory. The above-mentioned acquisition module 400, the first determination module 402, the first construction module 404, the second determination module 406, the third determination module 408, etc. are all stored in the memory as program modules, and the processor executes the above-mentioned program modules stored in the memory to realize corresponding functions.

[0119] The processor includes a kernel, which retrieves the corresponding program module from the memory. The kernel may be one or more. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. The memory includes at least one memory chip.

[0120] According to an embodiment of the present application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any of the network security detection methods for the power Internet of Things.

[0121] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group, and the non-volatile storage medium includes a stored program.

[0122] Optionally, when the program is running, the device where the non-volatile storage medium is located is controlled to perform the following functions: obtain data packets corresponding to multiple power Internet of Things devices in the power Internet of Things in the current sampling period, and obtain multiple initial data packets; based on a predetermined matching rule, determine multiple target data packets from the multiple initial data packets, and determine the first abnormality identification results corresponding to the multiple target data packets, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal characteristics of the data packet, and the number of the multiple target data packets is less than the number of the multiple initial data packets; construct a target network traffic distribution map based on the multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between multiple power Internet of Things devices in the current sampling period; based on the target network traffic distribution map, determine the second abnormality identification results corresponding to the multiple target data packets; based on the first abnormality identification results corresponding to the multiple target data packets, and the second abnormality identification results corresponding to the multiple target data packets, determine the network security detection result of the power Internet of Things in the current sampling period, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

[0123] According to an embodiment of the present application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein when the program is run, any of the network security detection methods for the power Internet of Things is executed.

[0124] According to an embodiment of the present application, an embodiment of a computer program product is also provided. When executed on a data processing device, it is suitable for executing a program that initializes any one of the above-mentioned network security detection method steps of the power Internet of Things.

[0125] Optionally, the above-mentioned computer program product, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: obtaining data packets corresponding to multiple power Internet of Things devices in the power Internet of Things in the current sampling period, and obtaining multiple initial data packets; based on predetermined matching rules, determining multiple target data packets from the multiple initial data packets, and determining first abnormality identification results corresponding to the multiple target data packets, wherein the predetermined matching rules are used to indicate the correspondence between the abnormal access type and the abnormal characteristics of the data packets, and the number of the multiple target data packets is less than the number of the multiple initial data packets; constructing a target network traffic distribution map based on the multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between the multiple power Internet of Things devices in the current sampling period; based on the target network traffic distribution map, determining second abnormality identification results corresponding to the multiple target data packets; based on the first abnormality identification results corresponding to the multiple target data packets, and the second abnormality identification results corresponding to the multiple target data packets, determining the network security detection result of the power Internet of Things in the current sampling period, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

[0126] An embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining data packets corresponding to multiple power Internet of Things devices in the power Internet of Things in the current sampling period to obtain multiple initial data packets; determining multiple target data packets from the multiple initial data packets based on a predetermined matching rule, and determining first abnormality identification results corresponding to the multiple target data packets, wherein the predetermined matching rule is used to indicate the correspondence between the abnormal access type and the abnormal feature of the data packet, and the number of the multiple target data packets is less than the number of the multiple initial data packets; constructing a target network traffic distribution map based on the multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between the multiple power Internet of Things devices in the current sampling period; determining second abnormality identification results corresponding to the multiple target data packets based on the target network traffic distribution map; determining the network security detection result of the power Internet of Things in the current sampling period based on the first abnormality identification results corresponding to the multiple target data packets and the second abnormality identification results corresponding to the multiple target data packets, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

[0127] The above sequence of the embodiments of the present invention is for description only and does not represent the superiority or inferiority of the embodiments.

[0128] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the above modules can be a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, modules or indirect coupling or communication connection of modules, which can be electrical or other forms.

[0130] The modules described above as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0131] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of software functional modules.

[0132] If the above-mentioned integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the various embodiments of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0133] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network security detection method for power Internet of Things, It is characterized in that include: Obtain data packets corresponding to multiple power Internet of Things devices in the power Internet of Things during the current sampling period, and obtain multiple initial data packets; Based on a predetermined matching rule, a plurality of target data packets are determined from the plurality of initial data packets, and first abnormality identification results respectively corresponding to the plurality of target data packets are determined, wherein the predetermined matching rule is used to indicate a corresponding relationship between an abnormal access type and an abnormal feature of a data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets; Constructing a target network traffic distribution graph based on multiple target data packets, wherein the target network traffic distribution graph is used to indicate the network traffic interaction relationship between the multiple power IoT devices within the current sampling period; Based on the target network traffic distribution graph, determine second anomaly identification results corresponding to the multiple target data packets respectively; Based on the first abnormal identification results corresponding to the multiple target data packets respectively, and the second abnormal identification results corresponding to the multiple target data packets respectively, the network security detection result of the power Internet of Things in the current sampling period is determined, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

2. The method according to claim 1, It is characterized in that The step of determining a plurality of target data packets from the plurality of initial data packets based on a predetermined matching rule, and determining first abnormality identification results respectively corresponding to the plurality of target data packets, comprises: Acquire header information corresponding to each of the plurality of initial data packets, wherein the header information is metadata for transmission and routing included in the corresponding initial data packets; Based on the header information, determining a plurality of first data packets from the plurality of initial data packets, wherein the number of the plurality of first data packets is less than the number of the plurality of initial data packets; Based on the port information respectively corresponding to the multiple initial data packets, determine a plurality of second data packets from the multiple initial data packets, wherein the number of the multiple second data packets is less than the number of the multiple initial data packets; Based on the multiple first data packets and the multiple second data packets, the multiple target data packets are obtained, and based on the predetermined matching rule, the first abnormality identification results respectively corresponding to the multiple target data packets are determined, wherein the number of the multiple target data packets is less than the number of the multiple first data packets, and the port information is used to indicate the port identifier of the corresponding first data packet on the corresponding power Internet of Things device.

3. The method according to claim 2, It is characterized in that The determining of first anomaly identification results respectively corresponding to the plurality of target data packets comprises: Based on the predetermined matching rule, determining the anomaly identification rules hit by the multiple target data packets respectively; Based on the regular expressions corresponding to the anomaly identification rules respectively hit by the multiple target data packets, it is detected whether the multiple target data packets hit the corresponding anomaly identification rules, and the first anomaly identification results respectively corresponding to the multiple target data packets are obtained.

4. The method according to claim 1, It is characterized in that The target network traffic distribution diagram is constructed based on multiple target data packets, including: Parsing the multiple target data packets respectively to obtain source addresses, destination addresses, network traffic and network traffic characteristics corresponding to the multiple target data packets respectively; Based on the source addresses, destination addresses, network traffic and network traffic characteristics respectively corresponding to the multiple target data packets, the target network traffic distribution graph is constructed with the multiple target data packets as nodes, directed line segments pointing from source addresses to destination addresses as edges, network traffic as edge weights, and network traffic characteristics as node characteristics.

5. The method according to claim 1, It is characterized in that The determining, based on the target network traffic distribution graph, second anomaly identification results corresponding to the plurality of target data packets respectively includes: Based on the target network traffic distribution diagram, a pre-trained classification model is used to obtain second anomaly recognition results corresponding to the multiple target data packets, wherein the second anomaly recognition results are used to indicate an abnormal probability of the corresponding target data packet and an abnormal access type corresponding to the target data packet; The classification model is based on the network traffic distribution diagrams obtained by the electric power Internet of Things in multiple historical sampling periods, and the anomaly recognition results corresponding to the data packets included in the corresponding network traffic distribution diagrams, and is trained using a graph convolutional neural network algorithm.

6. The method according to claim 1, It is characterized in that The first abnormality recognition results corresponding to the plurality of target data packets and the second abnormality recognition results corresponding to the plurality of target data packets respectively, Determining the network security detection result of the power Internet of Things during the current sampling period includes: Converting the first anomaly identification results respectively corresponding to the multiple target data packets into first trust distributions to obtain first trust distributions respectively corresponding to the multiple target data packets, wherein the first trust distributions are used to indicate the degree of trust in the first anomaly identification results; Converting the second anomaly identification results respectively corresponding to the multiple target data packets into second trust distributions to obtain second trust distributions respectively corresponding to the multiple target data packets, wherein the second trust distributions are used to indicate the degree of trust in the second anomaly identification results; Determine first index weights corresponding to the plurality of target data packets, respectively, and second index weights corresponding to the plurality of target data packets, respectively; Based on the first trust distribution, the first index weight, the second trust distribution, and the second index weight respectively corresponding to the multiple target data packets, obtaining target anomaly identification results respectively corresponding to the multiple target data packets; Based on the target anomaly identification results corresponding to the multiple target data packets, the network security detection result of the power Internet of Things in the current sampling period is determined.

7. The method according to claim 6, It is characterized in that The determining, based on the target anomaly identification results respectively corresponding to the multiple target data packets, the network security detection result of the electric power Internet of Things in the current sampling period includes: Determine the total network traffic within the electric power Internet of Things during the current sampling period; Based on the target anomaly identification results respectively corresponding to the multiple target data packets, determine multiple abnormal access types detected in the electric power Internet of Things during the current sampling period, and abnormal traffic within the electric power Internet of Things during the current sampling period; Determine the weight values ​​corresponding to the multiple abnormal access types, and the durations corresponding to the multiple abnormal access types; Based on the total network traffic and the abnormal traffic, determine the normal traffic within the electric power Internet of Things during the current sampling period; The network security detection result is determined based on the total network traffic, the normal traffic, the weight values ​​corresponding to the multiple abnormal access types, and the durations corresponding to the multiple abnormal access types.

8. A network security detection device for power Internet of Things, It is characterized in that include: An acquisition module is used to acquire data packets corresponding to multiple power Internet of Things devices in the power Internet of Things during the current sampling period, and obtain multiple initial data packets; A first determination module is used to determine a plurality of target data packets from the plurality of initial data packets based on a predetermined matching rule, and determine first abnormality identification results respectively corresponding to the plurality of target data packets, wherein the predetermined matching rule is used to indicate a corresponding relationship between an abnormal access type and an abnormal feature of a data packet, and the number of the plurality of target data packets is less than the number of the plurality of initial data packets; A first construction module is used to construct a target network traffic distribution map based on multiple target data packets, wherein the target network traffic distribution map is used to indicate the network traffic interaction relationship between the multiple power IoT devices within the current sampling period; A second determination module, configured to determine second anomaly identification results corresponding to the plurality of target data packets respectively based on the target network traffic distribution graph; The third determination module is used to determine the network security detection result of the power Internet of Things in the current sampling period based on the first abnormal identification results corresponding to the multiple target data packets respectively, and the second abnormal identification results corresponding to the multiple target data packets respectively, wherein the network security detection result is used to indicate whether there is an abnormal access data packet in the power Internet of Things.

9. A non-volatile storage medium, It is characterized in that The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the network security detection method for the electric power Internet of Things as described in any one of claims 1 to 7.

10. An electronic device, It is characterized in that It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the network security detection method for the electric power Internet of Things as described in any one of claims 1 to 7.

Images