Charging data intrusion feature detection method and device, storage medium and equipment

Abstract

The invention provides a charging data intrusion feature detection method and device, a storage medium and equipment, and the method comprises the steps: obtaining an electrical feature parameter set of charging data, and obtaining a time domain feature parameter set of the charging data according to the electrical feature parameter set; inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain an optimal time domain characteristic parameter of the charging data; and inputting the optimal time domain characteristic parameters of the charging data into a trained bidirectional long-short-term memory model to obtain a charging data intrusion behavior identification result. The intrusion characteristics of the charging data are detected through the bidirectional long-short-term memory network, so that the safety and accuracy of the charging data of the electric vehicle are improved, and benefits of clients and charging piles are prevented from being damaged by network attacks.

Description

Technical Field

[0001] The present invention relates to the field of power system network security, and in particular to a charging data intrusion feature detection method, device, storage medium and equipment. Background Art

[0002] With the construction of new power systems and the increasing number of electric vehicles, the power grid and third-party businesses have become more collaborative and interactive, and third-party aggregation businesses represented by electric vehicles have developed rapidly. Third-party aggregation businesses centrally manage and dispatch multiple scattered power resources through technical means to form virtual large-scale power resources, participate in power market transactions or provide ancillary services. The main responsibility of load aggregators is to connect users and the power market, and to uniformly dispatch and manage users' power demand and the market's power supply, thereby improving the competitiveness and efficiency of the power market.

[0003] However, due to the complexity of emerging business categories and uneven security protection levels, the behavior of electric vehicle user groups is unobservable, platform data is unmeasurable, and the aggregated business status is uncontrollable. As electric vehicle charging stations become increasingly intelligent, their vulnerability to network attacks has also increased. Electric vehicle charging stations are exposed to various network attacks, including denial of service (DoS), data spoofing, data replay, and data manipulation attacks.

[0004] In addition, due to the rapid development of various intelligent devices, systems and applications in third-party load aggregators, cross-information-physical domain power system attack and defense technology through network security means has become a new trend. The cross-domain attack and defense principles and key technologies for electric vehicles have become forward-looking issues that urgently need to be studied and solved. Summary of the invention

[0005] Based on this, the present invention provides a charging data intrusion feature detection method, device, storage medium and equipment, which identify possible data tampering during the charging process of an electric vehicle through bidirectional length and algorithm, thereby distinguishing between attack behavior and conventional charging abnormality process.

[0006] In a first aspect, the present invention provides a charging data intrusion feature detection method, comprising:

[0007] Acquire an electrical characteristic parameter set of charging data, and obtain a time domain characteristic parameter set of the charging data according to the electrical characteristic parameter set;

[0008] Inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data;

[0009] The optimal time domain feature parameters of the charging data are input into the trained bidirectional long short-term memory model to obtain the charging data intrusion behavior recognition result.

[0010] Furthermore, the electrical characteristic parameter set of the charging data includes voltage parameters, current parameters and frequency signal parameters on the charging bus at multiple moments;

[0011] The time domain characteristic parameter set of the charging data includes a charging data mean, a charging data standard deviation, a charging data root mean square, a charging data peak, a charging data skewness, a charging data influencing factor, and a charging data signal-to-noise ratio;

[0012] The time domain characteristic parameter set of charging data obtained according to the electrical characteristic parameter set is specifically: for any one of the voltage parameter, current parameter and frequency signal parameter on the charging bus at any moment in the electrical characteristic data parameter set as the charging data signal at that moment, the charging data mean, charging data standard deviation, charging data root mean square, charging data peak, charging data skewness, charging data influencing factor and charging data signal-to-noise ratio are calculated in combination with the time and space distribution characteristics.

[0013] Furthermore, the specific expression of the charging data mean is:

[0014] ,

[0015] in, is the mean value of charging data, For the The charging data signal at the moment of charging data collection, The number of charging data collected;

[0016] The specific expression of the standard deviation of charging data is:

[0017] ,

[0018] in, is the standard deviation of charging data;

[0019] The specific expression of the mean square error of the charging data is:

[0020] ,

[0021] in, is the RMS of charging data;

[0022] The expression of the charging data peak value is:

[0023] ,

[0024] in, It is the peak value of charging data;

[0025] The specific expression of the charging data skewness is:

[0026] ,

[0027] in, is the charging data skewness;

[0028] The specific expression of the charging data influencing factor is:

[0029] ,

[0030] in, is the charging data influencing factor, is the peak value of the charging data signal;

[0031] The specific expression of the charging data signal-to-noise ratio is:

[0032] ,

[0033] in, is the charging data signal-to-noise ratio, is the signal power of the charging data, is the noise power of the charging data.

[0034] Furthermore, the step of inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data includes:

[0035] Step S201, setting an initialized selected feature set and a best performance score;

[0036] Step S202, inputting the time domain characteristic parameter of any charging data into the initialized selected characteristic set to obtain a first selected characteristic set;

[0037] Step S203, inputting the first selected feature set into the feature search model to obtain a first performance score of the first selected feature set;

[0038] Step S204: if the first performance score is greater than the initialized best performance score, update the first performance score to the best performance score;

[0039] Step S205, repeating steps S202 to S204 until the time domain characteristic parameters of all charging data obtain a first performance score;

[0040] Step S206: updating the first selected feature set corresponding to the best performance score to the optimal selected feature set, and obtaining optimal time domain feature parameters of the charging data.

[0041] Furthermore, the specific expression of the bidirectional long short-term memory model is:

[0042]

[0043] in, is the input gate function of the bidirectional long short-term memory model, is the Sigmoid function, is the first weight matrix, is the second weight matrix, is the first bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data; is the forget gate function of the bidirectional long short-term memory model, is the third weight matrix, is the fourth weight matrix, is the second bias term; is the output gate function of the bidirectional long short-term memory model, is the fifth weight matrix, is the sixth weight matrix, is the third bias term; is the forward cell state, is the forward cell state at the previous moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term; is the backward cell state, is the backward cell state at the next moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term; is the forward hidden state; is the backward hidden state; is the output of the bidirectional long short-term memory model, is the output weight matrix, is the output bias term.

[0044] Furthermore, the charging data feature detection method further includes:

[0045] Step S301, obtaining an interactive topological relationship between an electric vehicle, an electric vehicle charging station and a power grid, and obtaining a charging data anomaly data set based on the interactive topological relationship;

[0046] Step S302, obtaining a time domain characteristic parameter set of the abnormal charging data according to the abnormal charging data data set, and inputting the time domain characteristic parameter set of the abnormal charging data into a characteristic search model to obtain an optimal time domain characteristic parameter of the abnormal charging data;

[0047] Step S303, inputting the training set into the bidirectional long short-term memory model for training to adjust the parameters of the bidirectional long short-term memory model, and inputting the test set into the trained bidirectional long short-term memory model to obtain a loss function;

[0048] Step S304, if the loss function is lower than the set threshold, return to step S303 to adjust the parameters of the bidirectional long short-term memory model;

[0049] Step S305: if the loss function is not lower than the set threshold, the trained bidirectional long short-term memory model is output.

[0050] Furthermore, the specific expression of the sensor reading when the charging data is invaded is:

[0051] ,

[0052] in, Time for charging data invasion The sensor readings, Sensor readings for charging data that have not been hacked, The impact of charging data being hacked.

[0053] In a second aspect, the present invention further provides a charging data intrusion feature detection device, comprising:

[0054] A parameter acquisition module, used to acquire an electrical characteristic parameter set of charging data, and obtain a time domain characteristic parameter set of charging data according to the electrical characteristic parameter set;

[0055] A parameter screening module, used for inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data;

[0056] The intrusion identification module is used to input the optimal time domain feature parameters of the charging data into the trained bidirectional long short-term memory model to obtain the charging data intrusion behavior identification result.

[0057] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the charging data intrusion feature detection methods in the first aspect.

[0058] In a fourth aspect, the present invention further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it executes any one of the charging data intrusion feature detection methods in the first aspect.

[0059] The beneficial effects of adopting the above technical solution are as follows: This embodiment improves the security and accuracy of electric vehicle charging data by detecting the intrusion characteristics of charging data through a bidirectional long short-term memory network, and prevents the interests of customers and charging piles from being damaged by network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0061] Figure 1 This is a schematic diagram of a charging data intrusion feature detection method in one embodiment of the present application;

[0062] Figure 2 This is a flow chart of a charging data intrusion feature detection method in one embodiment of the present application;

[0063] Figure 3 This is a schematic diagram of the topology of an electric vehicle charging station in one embodiment of the present application;

[0064] Figure 4 A schematic diagram showing the comparison of the effects of a bidirectional long short-term memory model and an existing detection method in one embodiment of the present application;

[0065] Figure 5 Schematic diagram of a charging data intrusion feature detection device in one embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In order to explain the present invention in more detail, the copper clad laminate sealing area identification method, device, storage medium and equipment provided by the present invention are specifically described below in combination with the drawings.

[0067] Unless otherwise defined, the technical terms or scientific terms used in the disclosure of this application should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, "one", "one" or "the" and other similar words do not indicate a quantitative limit, but indicate that there is at least one. "Including" or "including" and other similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and other similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship can also change accordingly.

[0068] With the construction of new power systems and the increasing number of electric vehicles, the power grid and third-party businesses have become more collaborative and interactive, and third-party aggregation businesses represented by electric vehicles have developed rapidly. Third-party aggregation businesses centrally manage and dispatch multiple scattered power resources through technical means to form virtual large-scale power resources, participate in power market transactions or provide ancillary services. The main responsibility of load aggregators is to connect users and the power market, and to uniformly dispatch and manage users' power demand and the market's power supply, thereby improving the competitiveness and efficiency of the power market.

[0069] However, due to the complexity of emerging business categories and uneven security protection levels, the behavior of electric vehicle user groups is unobservable, platform data is unmeasurable, and the aggregated business status is uncontrollable. As electric vehicle charging stations become increasingly intelligent, their vulnerability to network attacks has also increased. Electric vehicle charging stations are exposed to various network attacks, including denial of service (DoS), data spoofing, data replay, and data manipulation attacks.

[0070] In this regard, the present invention provides a method for detecting charging data intrusion characteristics, which uses a bidirectional long short-term memory network algorithm to identify possible intrusion and data tampering behaviors in electric vehicle charging data, thereby distinguishing attack behaviors from abnormal processes of regular charging behaviors. Figure 1 The schematic diagram of the charging data intrusion feature detection method and the attached Figure 2 A schematic flow chart of a method for detecting charging data intrusion features is shown.

[0071] The embodiment of the present application provides an application scenario of the method for detecting charging data intrusion features, and the application scenario includes the terminal device provided in the embodiment, and the terminal device includes but is not limited to a smart phone and a computer device, wherein the computer device can be at least one of a desktop computer, a portable computer, a laptop computer, a mainframe computer, a tablet computer, etc. The user operates the terminal device to obtain an identification result of whether the charging data is subject to intrusion or tampering. For the specific process, please refer to the embodiment of the method for detecting charging data intrusion features.

[0072] Step S101 : acquiring an electrical characteristic parameter set of charging data, and obtaining a time domain characteristic parameter set of the charging data according to the electrical characteristic parameter set.

[0073] Among them, the electrical characteristic data parameter set of charging data in this embodiment includes voltage parameters, current parameters, and frequency signal parameters on the charging bus at multiple times; for the above-mentioned electrical characteristic data parameter set, any one of the voltage parameters, current parameters, and frequency signal parameters on the charging bus at the same time is used as the charging data signal at that time, and the time domain characteristic parameters of the charging data are calculated in combination with the time and space distribution characteristics. The time domain characteristic parameter set of charging data includes the charging data mean, charging data standard deviation, charging data root mean square, charging data peak, charging data skewness, charging data influencing factor and charging data signal-to-noise ratio.

[0074] Specifically, the charging data mean value represents the average value of the charging data signal, and the specific expression is:

[0075] ,

[0076] in, is the mean value of charging data, For the The charging data signal at the moment of charging data collection, that is to say For the The voltage parameters, current parameters or frequency signal parameters on the charging bus at the moment of charging data collection, The number of charging data collected.

[0077] The standard deviation of charging data indicates the discreteness of the charging data signal. The specific expression is:

[0078] ,

[0079] in, is the standard deviation of charging data.

[0080] The mean square error of the charging data indicates the effective amplitude of the charging data signal. The specific expression is:

[0081] ,

[0082] in, is the RMS value of charging data.

[0083] The charging data peak value indicates the smoothness of the charging data signal distribution. When the charging data peak value is high, it means that the distribution is more uneven. When the charging data peak value is low, it means that the charging data distribution is relatively flat. The specific expression is:

[0084] ,

[0085] in, This is the peak value of charging data.

[0086] The charging data skewness indicates the symmetry of the charging data signal distribution. A positive skewness indicates that the charging data distribution has a longer tail on the right, and a negative skewness indicates that the charging data distribution has a longer tail on the left. The specific expression is:

[0087] ,

[0088] in, is the charging data skewness.

[0089] The charging data impact factor is the ratio of the peak value to the average value of the charging data signal. The charging data impact factor can be used to understand the relative height of the peak value and the average value. The specific expression is:

[0090] ,

[0091] in, is the charging data influencing factor, is the peak value of the charging data signal.

[0092] The charging data signal-to-noise ratio is the ratio of the charging data signal power to the noise power, indicating the signal quality of the charging data. When the signal-to-noise ratio is high, it means that the charging data signal is clearer and has less noise. The specific expression is:

[0093] ,

[0094] in, is the charging data signal-to-noise ratio, is the signal power of the charging data, is the noise power of the charging data.

[0095] Step S102: input the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameters of the charging data.

[0096] Specifically, the feature search model selects necessary features based on the feature search method of mean square error, narrows down the relevant features, reduces the dimensionality and improves the accuracy of the classifier. The time domain feature parameter set of the charging data is input into the feature search model to obtain the optimal time domain feature parameters of the charging data, which specifically includes the following steps:

[0097] Step S201, setting the initial selected feature set and the best performance score, wherein the initial selected feature set is recorded as , the best initial performance score is recorded as .

[0098] Step S202: input the time domain characteristic parameter of any charging data into the initialized selected feature set to obtain a first selected feature set. The first selected feature set can be recorded as ,in is the time domain characteristic parameter of charging data.

[0099] Step S203, inputting the first selected feature set into the feature search model to obtain a first performance score of the first selected feature set;

[0100] Step S204: if the first performance score is greater than the initialized best performance score, update the first performance score to the best performance score;

[0101] Step S205, repeating steps S202 to S204 until the time domain characteristic parameters of all charging data obtain a first performance score;

[0102] Step S206, updating the first selected feature set corresponding to the best performance score to the optimal selected feature set, and obtaining the optimal time domain feature parameters of the charging data, recorded as .

[0103] Step S103, inputting the optimal time domain feature parameters of the charging data into the trained bidirectional long short-term memory model to obtain a charging data intrusion behavior recognition result.

[0104] Specifically, the bidirectional long short-term memory model is different from the traditional long short-term memory model. The bidirectional long short-term memory model performs forward and backward processing in the input direction at the same time, allowing it to obtain information from both sides of the sequence. The forward long short-term memory model processes the input sequence forward, and the backward long short-term memory model processes the output sequence in reverse. Among them, the bidirectional long short-term memory model controls the management unit state through the input gate, the forget gate and the output gate, where the input gate determines which new inputs will be added to the unit state. The specific expression is:

[0105] ,

[0106] in, is the input gate function of the bidirectional long short-term memory model, which determines how much of the previous cell state should be retained. is the Sigmoid function, is the first weight matrix, is the second weight matrix, is the first bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data.

[0107] The forget gate determines which information is discarded from the cell state. The specific expression is:

[0108] ,

[0109] in, is the forget gate function of the bidirectional long short-term memory model, which determines how much of the previous cell state should be retained. is the Sigmoid function, is the third weight matrix, is the fourth weight matrix, is the second bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data.

[0110] The output gate determines which parts of the cell state will be output to the next time. The specific expression is:

[0111] ,

[0112] in, is the output gate function of the bidirectional long short-term memory model, is the Sigmoid function, is the fifth weight matrix, is the sixth weight matrix, is the third bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data.

[0113] The forward cell state is updated based on the forget gate and the input gate, and the nonlinear tanh function is used. The specific expression of the forward cell state is:

[0114] ,

[0115] in, is the forward cell state, is the forward cell state at the previous moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data.

[0116] The backward cell state is updated based on the forget gate and the input gate. The specific expression of the backward cell state is:

[0117] ,

[0118] in, is the backward cell state, is the backward cell state at the next moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data.

[0119] The forward hidden state is calculated by applying the nonlinear result of the output gate to the forward cell state. The specific expression of the forward hidden state is:

[0120]

[0121] in, is the forward hidden state.

[0122] The backward hidden state is calculated by applying the nonlinear result of the output gate to the backward cell state. The specific expression of the backward hidden state is:

[0123] ,

[0124] in, is the backward hidden state.

[0125] The output of the bidirectional long short-term memory model is obtained by connecting the forward hidden state and the backward hidden state, combining the weight matrix and the bias term. The specific expression is:

[0126] ,

[0127] is the output of the bidirectional long short-term memory model, is the output weight matrix, is the output bias term.

[0128] Based on the above equations, the architectural foundation of the bidirectional long short-term memory model is constructed, allowing information to flow bidirectionally in the sequence, thereby capturing past and future contextual information, and the above descriptions all revolve around time t.

[0129] In view of the above-mentioned charging data intrusion feature detection method, the training process of the bidirectional long short-term memory model in this embodiment is as follows:

[0130] Step S301, obtaining the interactive topological relationship between the electric vehicle, the electric vehicle charging station and the power grid, and obtaining a charging data anomaly data set based on the interactive topological relationship.

[0131] Specifically, combined with Figure 3 Based on the interactive topological relationship between electric vehicles, electric vehicle charging stations and power grids, combined with RTLAB simulation, an abnormal charging data dataset is obtained; the abnormal charging data dataset includes two types of data, one is the abnormal measurement signal dataset caused by the fluctuation characteristics of charging power and normal source and load of the power grid (for example, line faults, load switches, capacitor switching, etc.), and the other is the abnormal dataset caused by data manipulation attack behaviors. The complete abnormal charging data dataset is obtained through the Monte Carlo simulation method.

[0132] Step S302: obtaining a time domain characteristic parameter set of the abnormal charging data according to the abnormal charging data data set, and inputting the time domain characteristic parameter set of the abnormal charging data into a characteristic search model to obtain an optimal time domain characteristic parameter of the abnormal charging data.

[0133] Step S302: dividing the optimal time-domain characteristic parameters of the abnormal charging data into a training set and a test set according to a preset ratio.

[0134] Specifically, in this embodiment, the preset ratio is training set: test set = 7: 3. Those skilled in the art may also set other preset ratio values ​​according to actual needs, as long as the ratio of the training set is higher than the ratio of the test set.

[0135] Step S303: input the training set into the bidirectional long short-term memory model for training to adjust the parameters of the bidirectional long short-term memory model, and input the test set into the trained bidirectional long short-term memory model to obtain a loss function.

[0136] Specifically, the Adam optimizer is used to optimize the parameters of the bidirectional long short-term memory model, and the loss function is defined as Binary cross entropy, which is suitable for binary classification problems. By optimizing and adjusting the parameters of the bidirectional long short-term memory model, the intrusion feature detection of the charging data test set by the trained bidirectional long short-term memory model remains consistent with the intrusion feature detection of the actual charging data.

[0137] Step S304: If the loss function is lower than the set threshold, return to step S303 to adjust the parameters of the bidirectional long short-term memory model.

[0138] Step S305: if the loss function is not lower than the set threshold, the trained bidirectional long short-term memory model is output.

[0139] Furthermore, it should be noted that the method for detecting charging data intrusion features in this embodiment is mainly aimed at data manipulation attacks, where attackers tamper with data in the charging transmission of electric vehicles, such as sensor base data, charging commands or transaction records. Attackers may modify data to deceive the system, manipulate charging parameters or introduce false information, thereby establishing the basic construction of charging data intrusion:

[0140] ,

[0141] in, Time for charging data invasion The sensor readings, Sensor readings for charging data that have not been hacked, The impact of charging data being hacked. In this paper, two different invasion variants are introduced: offset influence and scaling influence. The specific expressions are:

[0142]

[0143] in, For the offset effect, To scale the impact, is the input signal, The intrusion factors are used to offset and scale the input signals, resulting in serious deviations in charging data, including but not limited to incorrect billing, tampering of charging parameters, or other safety issues in the charging process. These intrusions may cause economic losses, damage to electric vehicles, or pose safety risks to infrastructure.

[0144] In order to better illustrate that the bidirectional long short-term memory model adopted in this application has a higher accuracy in the process of charging data intrusion feature detection, the bidirectional long short-term memory model (Bi-LSTM) of this embodiment is compared with the existing long short-term memory network model (LSTM), multi-layer perceptron model (MLP), support vector machine model (SVM) and linear regression model (LR) in the accuracy of charging data intrusion feature detection, as shown in Table 1.

[0145]

[0146] Table 1 Performance comparison of bidirectional long short-term memory model and other existing models

[0147] Comparing the performance parameters of the bidirectional long short-term memory model of this embodiment with other existing models shown in Table 1, it can be seen that the bidirectional long short-term memory model of this embodiment has strong precision, recall rate and F1 value.

[0148] In practical applications, it is crucial to evaluate the robustness of deep learning models to noise and uncertainty. Power systems are often faced with noisy data, and it is crucial to ensure that the model can operate reliably under these conditions. In order to evaluate the robustness of the proposed method, the accuracy of each method under different noise and uncertainty environments is compared. Figure 4 The results in show that Bi-LSTM can perform effectively even in the presence of noise. The proposed method accurately recognizes the noisy data and achieves an average test accuracy of 99.23% under joint noise conditions. LSTM and artificial neural network (ANN) perform worse than the proposed Bi-LSTM method under noisy conditions.

[0149] It should be understood that although the Figure 1-2 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Figure 1-2 At least part of the steps may include multiple sub-steps or sub-stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0150] The above embodiments of the present invention describe in detail the charging data intrusion feature detection method. The above methods disclosed in the present invention can be implemented by various devices. Therefore, the present invention also discloses a charging data intrusion feature detection device. Figure 5, specific embodiments are given below to explain in detail.

[0151] The parameter acquisition module 401 is used to acquire an electrical characteristic parameter set of the charging data, and obtain a time domain characteristic parameter set of the charging data according to the electrical characteristic parameter set;

[0152] A parameter screening module 402, configured to input the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data;

[0153] The intrusion identification module 403 is used to input the optimal time domain feature parameters of the charging data into the trained bidirectional long short-term memory model to obtain the charging data intrusion behavior identification result.

[0154] For the charging data intrusion feature detection device, please refer to the above definition of the method, which will not be repeated here. Each module in the above device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor of the terminal device in the form of hardware, or stored in the memory of the terminal device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0155] In one embodiment, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned charging data intrusion feature detection method are implemented.

[0156] The computer-readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM (erasable programmable read-only memory), a hard disk or a ROM. Optionally, the computer-readable storage medium includes a non-transitory computer-readable storage medium. The computer-readable storage medium has a storage space for program codes for executing any method step of the above method. These program codes may be read from or written into one or more computer program products, and the program codes may be compressed in an appropriate form.

[0157] In one embodiment, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the above-mentioned charging data intrusion feature detection method when executing the computer program.

[0158] The computer device includes a memory, a processor, and one or more computer programs, wherein the one or more computer programs can be stored in the memory and configured to be executed by one or more processors, and the one or more application programs are configured to execute the above-mentioned charging data intrusion feature detection method.

[0159] The processor may include one or more processing cores. The processor uses various interfaces and lines to connect the various parts of the entire computer device, and executes various functions of the computer device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor can integrate one or more combinations of a central processing unit (Central Processing Unit, CPU), a reporting verifier (Graphics Processing Unit, GPU) for buried data, and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but may be implemented separately through a communication chip.

[0160] The memory may include a random access memory (RAM) or a read-only memory (ROM). The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the terminal device during use, etc.

[0161] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A charging data intrusion feature detection method, characterized in that: include: Acquire an electrical characteristic parameter set of charging data, and obtain a time domain characteristic parameter set of the charging data according to the electrical characteristic parameter set; Inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data; The optimal time domain feature parameters of the charging data are input into the trained bidirectional long short-term memory model to obtain the charging data intrusion behavior recognition result.

2. The charging data intrusion feature detection method according to claim 1, characterized in that: The electrical characteristic parameter set of the charging data includes voltage parameters, current parameters and frequency signal parameters on the charging bus at multiple times; The time domain characteristic parameter set of the charging data includes a charging data mean, a charging data standard deviation, a charging data root mean square, a charging data peak, a charging data skewness, a charging data influencing factor, and a charging data signal-to-noise ratio; The time domain characteristic parameter set of charging data obtained according to the electrical characteristic parameter set is specifically: for any one of the voltage parameter, current parameter and frequency signal parameter on the charging bus at any moment in the electrical characteristic data parameter set as the charging data signal at that moment, the charging data mean, charging data standard deviation, charging data root mean square, charging data peak, charging data skewness, charging data influencing factor and charging data signal-to-noise ratio are calculated in combination with the time and space distribution characteristics.

3. The charging data intrusion feature detection method according to claim 2, characterized in that: The specific expression of the charging data mean is: ， in, is the mean value of charging data, For the The charging data signal at the moment of charging data collection, The number of charging data collected; The specific expression of the standard deviation of charging data is: ， in, is the standard deviation of charging data; The specific expression of the mean square error of the charging data is: ， in, is the RMS of charging data; The expression of the charging data peak value is: ， in, It is the peak value of charging data; The specific expression of the charging data skewness is: ， in, is the charging data skewness; The specific expression of the charging data influencing factor is: ， in, is the charging data influencing factor, is the peak value of the charging data signal; The specific expression of the charging data signal-to-noise ratio is: ， in, is the charging data signal-to-noise ratio, is the signal power of the charging data, is the noise power of the charging data.

4. The charging data intrusion feature detection method according to claim 3, characterized in that: The step of inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data includes: Step S201, setting an initialized selected feature set and a best performance score; Step S202, inputting the time domain characteristic parameter of any charging data into the initialized selected characteristic set to obtain a first selected characteristic set; Step S203, inputting the first selected feature set into the feature search model to obtain a first performance score of the first selected feature set; Step S204: if the first performance score is greater than the initialized best performance score, update the first performance score to the best performance score; Step S205, repeating steps S202 to S204 until the time domain characteristic parameters of all charging data obtain a first performance score; Step S206: updating the first selected feature set corresponding to the best performance score to the optimal selected feature set, and obtaining optimal time domain feature parameters of the charging data.

5. The charging data intrusion feature detection method according to claim 4, characterized in that: The specific expression of the bidirectional long short-term memory model is: in, is the input gate function of the bidirectional long short-term memory model, is the Sigmoid function, is the first weight matrix, is the second weight matrix, is the first bias term, is the hidden state at the previous moment, is the hidden state at the next moment, is the optimal time domain characteristic parameter of charging data; is the forget gate function of the bidirectional long short-term memory model, is the third weight matrix, is the fourth weight matrix, is the second bias term; is the output gate function of the bidirectional long short-term memory model, is the fifth weight matrix, is the sixth weight matrix, is the third bias term; is the forward cell state, is the forward cell state at the previous moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term; is the backward cell state, is the backward cell state at the next moment, is the seventh weight matrix, is the eighth weight matrix, is the fourth bias term; is the forward hidden state; is the backward hidden state; is the output of the bidirectional long short-term memory model, is the output weight matrix, is the output bias term.

6. The charging data intrusion feature detection method according to claim 5, characterized in that: Also includes: Step S301, obtaining an interactive topological relationship between an electric vehicle, an electric vehicle charging station and a power grid, and obtaining a charging data anomaly data set based on the interactive topological relationship; Step S302, obtaining a time domain characteristic parameter set of the abnormal charging data according to the abnormal charging data data set, and inputting the time domain characteristic parameter set of the abnormal charging data into a characteristic search model to obtain an optimal time domain characteristic parameter of the abnormal charging data; Step S303, inputting the training set into the bidirectional long short-term memory model for training to adjust the parameters of the bidirectional long short-term memory model, and inputting the test set into the trained bidirectional long short-term memory model to obtain a loss function; Step S304, if the loss function is lower than the set threshold, return to step S303 to adjust the parameters of the bidirectional long short-term memory model; Step S305: if the loss function is not lower than the set threshold, the trained bidirectional long short-term memory model is output.

7. The charging data intrusion feature detection method according to claim 6, characterized in that: The specific expression of the sensor reading during the charging data invasion is: ， in, Time for charging data invasion The sensor readings, Sensor readings for charging data that have not been hacked, The impact of charging data being hacked.

8. A charging data intrusion feature detection device, characterized in that: include: A parameter acquisition module, used to acquire an electrical characteristic parameter set of charging data, and obtain a time domain characteristic parameter set of charging data according to the electrical characteristic parameter set; A parameter screening module, used for inputting the time domain characteristic parameter set of the charging data into a characteristic search model to obtain the optimal time domain characteristic parameter of the charging data; The intrusion identification module is used to input the optimal time domain feature parameters of the charging data into the trained bidirectional long short-term memory model to obtain the charging data intrusion behavior identification result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the charging data intrusion feature detection method according to any one of claims 1 to 7 are implemented.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it performs the charging data intrusion feature detection method according to any one of claims 1 to 7.

Images