Charging pile flow intrusion detection method and device, equipment and storage medium

Abstract

The invention discloses a charging pile traffic intrusion detection method, device and equipment and a storage medium, and relates to the technical field of smart grid safety, and the method comprises the steps: inputting real sample traffic features extracted from an electric vehicle charging pile into a generator of a generative adversarial network to obtain deception sample traffic features; inputting the deception traffic sample features into a discriminator of the generative adversarial network for verification; combining the real sample traffic characteristics and the deception traffic sample characteristics into a training data set under the condition that the discriminator passes the verification of the deception traffic sample characteristics; training a traffic intrusion prediction model by using the training data set; and detecting whether the data traffic of the electric vehicle charging pile has a traffic intrusion behavior or not by using the trained traffic intrusion prediction model.

Description

Technical Field

[0001] The present application relates to the field of smart grid security technology, and in particular to a method, device, equipment and storage medium for detecting charging pile flow intrusion. Background Art

[0002] Charging piles are an indispensable part of the development of electric vehicles and smart cities. Both electric vehicles and charging piles are connected to the power grid, so there is a possibility of fire. In particular, malicious attackers can directly affect the instantaneous load of the power grid by controlling the host of the charging pile. Malicious attackers control the power grid to charge and discharge at the same time, which not only has a great impact on the stability of the power grid, but may also cause problems such as short circuits in the charging piles, which in turn affects the safety of electric vehicles.

[0003] Currently, a large number of charging piles lack effective defense mechanisms, which makes many charging devices vulnerable to hackers, resulting in security issues such as charging pile DoS and backdoor vulnerabilities. This not only increases the risk of user privacy information leakage, but also increases security risks. In the prior art, the usual way of traffic detection is to analyze the traffic behavior in the network system. If abnormal or unauthorized traffic activities are found, abnormal traffic results will be prompted.

[0004] However, this is only obtained through training based on a large number of existing traffic data sets. Charging pile intrusion detection is an emerging field. The lack of effective intrusion traffic data leads to a very uneven data distribution, which results in poor detection model effectiveness and weak robustness of the model. Summary of the invention

[0005] The purpose of this application is to provide a method, device, equipment and storage medium for detecting charging pile traffic intrusion.

[0006] To achieve the above objectives, this application provides the following solutions:

[0007] In a first aspect, the present application provides a method for detecting charging pile traffic intrusion, comprising:

[0008] The real sample traffic features extracted from the electric vehicle charging pile are input into the generator of the adversarial generation network to obtain the deceptive sample traffic features;

[0009] Inputting the deceptive traffic sample features into the discriminator of the adversarial generation network for verification;

[0010] In the case where the discriminator verifies the fraudulent traffic sample feature, combining the real sample traffic feature and the fraudulent traffic sample feature into a training data set;

[0011] Using the training data set to train the traffic intrusion prediction model;

[0012] The trained traffic intrusion prediction model is used to detect whether there is any traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

[0013] Optionally, the step of inputting the real sample traffic feature into a generator of a generative adversarial network to obtain a deceptive sample traffic feature includes:

[0014] Inputting the real sample flow characteristics into a generator of a generative adversarial network so that the generator learns the characteristic distribution of the real sample quantity characteristics;

[0015] Random noise is input into the generator after learning the feature distribution to obtain the deceptive sample traffic feature.

[0016] Optionally, the step of inputting the fraudulent traffic sample feature into the discriminator of the adversarial generation network for verification includes:

[0017] Inputting the deceptive traffic sample feature and the real sample traffic feature into the discriminator of the adversarial generation network to obtain a first probability value that the real traffic sample feature is true and a second probability value that the deceptive sample traffic feature is true;

[0018] Inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value;

[0019] When the optimization function value reaches the optimization requirement, confirming that the discriminator has passed the verification of the fraudulent traffic sample feature;

[0020] When the evaluation function value does not meet the training requirement, the discriminator continues to be trained.

[0021] Optionally, the step of inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value includes:

[0022] The first probability value and the second probability value are input into the following optimization function:

[0023]

[0024] Wherein, V(D,G) represents the optimization function, D(x) represents the first probability value that the judger identifies the real traffic sample feature x as true, 1-D(G(z)) represents the second probability value that the judger identifies the fraudulent traffic sample feature z as true, y represents the label of the real traffic sample feature x, D(x|y) represents the joint probability value that the judger identifies the real traffic sample feature x marked with label y as true, P data (x) represents the data distribution of real traffic sample characteristics, P z(z) represents the data distribution of the characteristics of deceptive traffic samples.

[0025] Optionally, the traffic intrusion prediction model includes at least: a Bi-LSTM model and a self-attention model;

[0026] The step of training the traffic intrusion prediction model using the training data set includes:

[0027] Inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector;

[0028] Inputting the training feature vector into the self-attention model to obtain a prediction result;

[0029] Calculating a loss value corresponding to the prediction result;

[0030] When the loss value is less than the loss value threshold, it is confirmed that the training of the traffic intrusion prediction model is completed.

[0031] Optionally, the step of inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector includes:

[0032] The training data set is input into the following Bi-LSTM model:

[0033]

[0034] Among them, W f is the weight coefficient of the forget gate, W u is the weight coefficient of the input gate, W o is the weight coefficient of the output gate, W c is the weight coefficient of the traffic feature extraction process, b f represents the bias value of the forget gate, b u represents the bias value of the input gate, b o represents the bias value of the output gate, b c Indicates the bias value of the flow feature extraction process. h (t-1) represents the hidden state h of the model at time t-1, x (t) represents the model input at time t, and σ() represents the activation function Sigmoid. t and Both represent the state of the network node, and they represent the state of the nerve cell at time t and the temporary state of the nerve cell respectively. t is the hidden state of the model.

[0035] Optionally, the step of inputting the training feature vector into the self-attention model to obtain a prediction result includes:

[0036] The training feature vector is input into the following formula to obtain the prediction result:

[0037] K=W k *h t +b k ;

[0038] a t =Attention(Q,K,Vet);

[0039]

[0040] Among them, W k is the weight coefficient of feature conversion, b k Indicates the bias value of model feature transformation. a t is the output of the attention model, Vet represents the vector of input features, Q and K both represent the feature vectors for calculating the Attention weights, and W a is the weight coefficient of model feature transformation, b a Indicates the bias value of model feature transformation.

[0041] In a second aspect, the present application provides a device for detecting charging pile traffic intrusion, including:

[0042] The adversarial generative network module is used to input the real sample traffic features extracted from the electric vehicle charging pile into the generator of the adversarial generative network to obtain the deceptive sample traffic features;

[0043] Inputting the deceptive traffic sample features into the discriminator of the adversarial generation network for verification;

[0044] In the case where the discriminator verifies the fraudulent traffic sample feature, combining the real sample traffic feature and the fraudulent traffic sample feature into a training data set;

[0045] A model training module, used to train a traffic intrusion prediction model using the training data set;

[0046] The model prediction module is used to use the trained traffic intrusion prediction model to detect whether there is traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

[0047] Optionally, the adversarial generative network module is further used to:

[0048] Inputting the real sample flow characteristics into a generator of a generative adversarial network so that the generator learns the characteristic distribution of the real sample quantity characteristics;

[0049] Random noise is input into the generator after learning the feature distribution to obtain the deceptive sample traffic feature.

[0050] Optionally, the adversarial generative network module is further used to:

[0051] Inputting the deceptive traffic sample feature and the real sample traffic feature into the discriminator of the adversarial generation network to obtain a first probability value that the real traffic sample feature is true and a second probability value that the deceptive sample traffic feature is true;

[0052] Inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value;

[0053] When the optimization function value reaches the optimization requirement, confirming that the discriminator has passed the verification of the fraudulent traffic sample feature;

[0054] When the evaluation function value does not meet the training requirement, the discriminator continues to be trained.

[0055] Optionally, the adversarial generative network module is further used to:

[0056] The first probability value and the second probability value are input into the following optimization function:

[0057]

[0058] Wherein, V(D,G) represents the optimization function, D(x) represents the first probability value that the judger identifies the real traffic sample feature x as true, 1-D(G(z)) represents the second probability value that the judger identifies the fraudulent traffic sample feature z as true, y represents the label of the real traffic sample feature x, D(x|y) represents the joint probability value that the judger identifies the real traffic sample feature x marked with label y as true, P data (x) represents the data distribution of real traffic sample characteristics, P z (z) represents the data distribution of the characteristics of deceptive traffic samples.

[0059] Optionally, the traffic intrusion prediction model includes at least: a Bi-LSTM model and a self-attention model;

[0060] The model training module is also used for:

[0061] Inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector;

[0062] Inputting the training feature vector into the self-attention model to obtain a prediction result;

[0063] Calculating a loss value corresponding to the prediction result;

[0064] When the loss value is less than the loss value threshold, it is confirmed that the training of the traffic intrusion prediction model is completed.

[0065] Optionally, the model training module is further used to:

[0066] The training data set is input into the following Bi-LSTM model:

[0067]

[0068] Among them, W f is the weight coefficient of the forget gate, W u is the weight coefficient of the input gate, W o is the weight coefficient of the output gate, W c is the weight coefficient of the traffic feature extraction process, b f represents the bias value of the forget gate, b u represents the bias value of the input gate, b o represents the bias value of the output gate, b c Indicates the bias value of the flow feature extraction process. h (t-1) represents the hidden state h of the model at time t-1, x (t) represents the model input at time t, and σ() represents the activation function Sigmoid. t and Both represent the state of the network node, and they represent the state of the nerve cell at time t and the temporary state of the nerve cell respectively. t is the hidden state of the model.

[0069] Optionally, the model training module is further used to:

[0070] The training feature vector is input into the following formula to obtain the prediction result:

[0071] K=W k *h t +b k ;

[0072] a t =Attention(Q,K,Vet);

[0073]

[0074] Among them, W k is the weight coefficient of feature conversion, b k Indicates the bias value of model feature transformation. a t is the output of the attention model, Vet represents the vector of input features, Q and K both represent the feature vectors for calculating the Attention weights, and W a is the weight coefficient of model feature transformation, b a Indicates the bias value of model feature transformation.

[0075] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the charging pile traffic intrusion detection method described in any one of the above.

[0076] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the charging pile traffic intrusion detection method described in any one of the above.

[0077] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the charging pile traffic intrusion detection method described in any one of the above.

[0078] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0079] The present application provides a method, device, equipment and storage medium for detecting charging pile traffic intrusion. The present invention uses a generator of an adversarial generative network to learn real traffic sample features to generate deceptive traffic sample features that conform to the distribution of malicious intrusion traffic sample features, and successfully passes the verification of a discriminator, thereby using a training machine composed of the generated real traffic sample features and deceptive traffic sample features to train a traffic intrusion prediction model, thereby solving the current problems of less charging pile intrusion data and unbalanced data categories, ensuring the data quality of the traffic intrusion prediction model training, and improving the accuracy of traffic intrusion behavior prediction for electric vehicle charging piles. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0081] Figure 1 A flow chart of a method for detecting charging pile traffic intrusion provided in one embodiment of the present application;

[0082] Figure 2 A schematic diagram of the architecture of a method for detecting charging pile traffic intrusion provided in one embodiment of the present application;

[0083] Figure 3 A schematic diagram of the principle of a method for detecting charging pile traffic intrusion provided in one embodiment of the present application;

[0084] Figure 4A schematic diagram of functional modules of a charging pile flow intrusion detection device provided in one embodiment of the present application;

[0085] Figure 5 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0086] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0087] like Figure 1 As shown, some embodiments of the present application provide a method for detecting charging pile traffic intrusion, which includes the following steps 101 to 104. Among them:

[0088] In step 101, the real sample traffic features extracted from the electric vehicle charging pile are input into the generator of the adversarial generative network to obtain the deceptive sample traffic features.

[0089] In the embodiment of the present application, the system monitors and extracts traffic events from the electric vehicle charging pile in real time. These traffic events contain real sample traffic features, which may include traffic information features and data packet features. The traffic information features include src_ip, dst_ip, src_mac, dst_mac target and source traffic port IP and MAC addresses, src_port source traffic port, vlan_id wireless gateway and other information. These features can detect malicious intrusions from which port and address the information is transmitted, but these features have a high degree of overlap and poor recognition of malicious intrusions. The features of another type of data packet include protocol protocol type, dst2src_packets target address to source address packet size, src2dst_packets source address to target address packet size, bidirectional_packets traffic bidirectional data packet size, bidirectional_syn_packets bidirectional syn signal packet size, src2dst_duration_ms source address to target address duration (in milliseconds), dst2src_first_seen_ms first group of source address to target address timestamp (in milliseconds)

[0090] Unit) etc.

[0091] The system then screens and preprocesses the extracted real sample traffic feature data. Since there are a large number of real sample traffic features and the amplitude span between data features is large, this leads to a slow convergence of the training model. Therefore, the real sample traffic features can be screened to remove the real sample traffic features with fewer information categories. This operation can reduce the training time of the detection model. In addition, in order to facilitate the deep learning model to quantify the intrusion samples, the z-score feature standardization processing method can also be used to unify the distribution of sample features. The z-score feature standardization processing method can refer to the following formula (1):

[0092]

[0093] Among them, x j is the jth feature of sample x, μ j and δ j are the mean and variance of the jth feature data, x s is the normalized feature data. After filtering the above data features, this feature processing operation not only accelerates the quantitative characterization of samples by the deep model, but also filters out irrelevant features in traffic events, thereby improving the detection accuracy of the model.

[0094] Step 102: input the fraudulent traffic sample features into the discriminator of the generative adversarial network for verification.

[0095] In an embodiment of the present application, the preprocessed real sample traffic features are then input into the generator (G) of the Generative Adversarial Networks (GAN). The goal of the generator is to learn its data distribution based on the input real sample traffic features, and generate deceptive sample traffic features that are similar to but not exactly the same as the real samples. This is achieved through the neural network structure and training algorithm inside the generator, such as using deep neural networks (DNN) or convolutional neural networks (CNN) to capture the complex features of the data.

[0096] The generated spoof sample traffic features are then input into the discriminator (Discriminator, D) of the adversarial generative network for verification. The task of the discriminator is to distinguish whether the input data sample is real or a spoof sample generated by the generator. It performs feature analysis and pattern recognition on the input sample and outputs a probability value indicating the possibility that the sample is a real sample. In the case where the discriminator verifies the spoof sample traffic features, that is, the discriminator cannot accurately distinguish between real samples and spoof samples and reach Nash equilibrium, these spoof sample traffic features are regarded as valid training data.

[0097] Step 103, when the discriminator passes the verification of the fraudulent traffic sample feature, the real sample traffic feature and the fraudulent traffic sample feature are combined into a training data set.

[0098] Step 104: Use the training data set to train the traffic intrusion prediction model.

[0099] In the application embodiment, these deceptive sample traffic features are combined with the real sample traffic features in a certain proportion into a new training data set. Thereby increasing the diversity and scale of the training data set, especially for those scarce or unbalanced malicious traffic categories, thereby improving the robustness and detection accuracy of the model. The combined training data set is used to train the traffic intrusion prediction model. The model can use deep learning techniques, such as bidirectional long short-term memory network (Bi-LSTM) combined with attention mechanism (AttentionMechanism), to conduct in-depth mining and characterization learning of traffic feature data. The model continuously optimizes its parameters through the back-propagation algorithm to improve the ability to identify malicious traffic behavior.

[0100] Step 105: Use the trained traffic intrusion prediction model to detect whether there is any traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

[0101] The trained traffic intrusion prediction model is used to detect whether there is traffic intrusion in the data traffic of the electric vehicle charging pile. By inputting the real-time collected charging pile traffic feature data into the model, the model will output a prediction result, that is, whether the traffic data is a malicious intrusion behavior. Based on the prediction results, the system can issue an alarm in time and take defensive measures to ensure the safe and stable operation of the charging pile and the power grid.

[0102] The embodiment of the present application uses the generator of the adversarial generative network to learn the real traffic sample characteristics to generate deceptive traffic sample characteristics that conform to the distribution of malicious intrusion traffic sample characteristics, and successfully passes the verification of the discriminator, thereby using the training loop composed of the generated real traffic sample characteristics and the deceptive traffic sample characteristics to train the traffic intrusion prediction model, thereby solving the current problems of less charging pile intrusion data and unbalanced data categories, ensuring the data quality of the traffic intrusion prediction model training, and improving the accuracy of the prediction of traffic intrusion behavior of electric vehicle charging piles.

[0103] Optionally, the step 102 includes:

[0104] Step 1021: input the real sample flow characteristics into the generator of the adversarial generative network so that the generator learns the characteristic distribution of the real sample quantity characteristics.

[0105] Step 1022, inputting random noise into the generator after learning the characteristic distribution, to obtain the deceptive sample traffic characteristics.

[0106] In an embodiment of the present application, the task of the generator is to learn the characteristic distribution of these real sample traffic characteristics. The characteristic distribution refers to the distribution of these characteristic data in the sample, such as which IP address and port number combinations are common and which are uncommon. By learning these characteristic distributions, the generator can gradually grasp the pattern of real traffic data. By learning these characteristic distributions, the generator can gradually simulate false data similar to real data. This learning process is completed through a large number of iterative trainings, and in each iteration, the generator will try to generate false data that is closer to the real data.

[0107] After the generator successfully learns the characteristic distribution of real sample traffic features, it can use this learned knowledge to generate new data. The generator receives random noise as input. By transforming this random noise into data with a specific distribution, the generator is able to create deceptive sample traffic features similar to real data. Random noise is a random sequence of numbers with no actual meaning, but through the generator's transformation, they are given structures and features similar to real data.

[0108] After being processed by the generator, random noise is converted into deceptive sample traffic features. These deceptive samples are very similar to real samples in feature distribution and can even deceive the discriminator. During the training process, the discriminator will constantly try to distinguish between real samples and deceptive samples generated by the generator, but as the generator's capabilities improve, the difficulty of the discriminator in distinguishing between real and deceptive samples will gradually increase.

[0109] The embodiment of the present application can generate a large number of deceptive samples similar to the real charging pile traffic characteristics through the adversarial generative network. These deceptive samples not only enrich the training data set, but also solve the problem of data category imbalance, thereby improving the robustness and detection accuracy of the detection model.

[0110] Optionally, the step 103 includes:

[0111] Step 1031, input the deceptive traffic sample feature and the real sample traffic feature into the discriminator of the adversarial generation network to obtain a first probability value that the real traffic sample feature is true and a second probability value that the deceptive sample traffic feature is true.

[0112] Step 1032: input the first probability value and the second probability value into an optimization function to obtain an optimization function value.

[0113] Step 1033, when the optimization function value reaches the optimization requirement, confirm that the discriminator has passed the verification of the fraudulent traffic sample feature.

[0114] Step 1034: When the evaluation function value does not meet the training requirement, continue to train the discriminator.

[0115] In an embodiment of the present application, the system simultaneously inputs the deceptive traffic sample features and the real sample traffic features into the discriminator of the adversarial generative network (GAN). The goal of the discriminator is to distinguish whether the input data is real data or deceptive data generated by the generator. After receiving these two types of data, the discriminator will output two first probability values ​​and second probability values. The first probability value represents the probability that the discriminator believes that the input real traffic sample features are true. The second probability value represents the probability that the discriminator believes that the input deceptive sample traffic features are true. The two probability values ​​are input into the optimization function to calculate an optimization function value. The optimization function is designed to guide the training process of the GAN so that the generator can generate deceptive samples that are more difficult to be identified by the discriminator. The specific form of the optimization function may vary depending on the specific implementation of the GAN, but it usually includes two parts: one part is the discriminator's accuracy of distinguishing real samples, and the other part is the discriminator's accuracy of distinguishing deceptive samples. The goal of the optimization function is to minimize the difference between the accuracy of these two parts, that is, to make the discriminator's ability to distinguish real samples and deceptive samples as close as possible.

[0116] During the training process, the optimization function value is continuously calculated and compared with the preset optimization requirements. If the optimization function value reaches the optimization requirements, that is, the discriminator's ability to distinguish between real samples and deceptive samples reaches the preset accuracy level, then it can be considered that the discriminator has been trained and the verification of the characteristics of the deceptive traffic samples has passed. If the optimization function value does not meet the training requirements, that is, the discriminator's ability to distinguish between deceptive samples is not strong enough, or the ability to distinguish between real samples has decreased, then the discriminator needs to continue to be trained. During the training process, the parameters of the discriminator will be continuously adjusted to improve its discrimination ability. At the same time, the generator will also be adjusted according to the feedback from the discriminator to generate more difficult to identify deceptive samples to promote the overall training process of GAN.

[0117] In the embodiment of the present application, the generator in the adversarial generative network is adjusted according to the feedback of the discriminator to generate more difficult to identify deceptive samples. This adversarial training process not only improves the accuracy of the discriminator, but also improves the deception ability of the generator, thereby solving the problem of data category imbalance in charging pile traffic intrusion detection and improving the robustness and detection accuracy of the detection model.

[0118] Optionally, the step 1032 includes: inputting the first probability value and the second probability value into the following optimization function:

[0119]

[0120] Wherein, V(D,G) represents the optimization function, D(x) represents the first probability value that the judger identifies the real traffic sample feature x as true, 1-D(G(z)) represents the second probability value that the judger identifies the fraudulent traffic sample feature z as true, y represents the label of the real traffic sample feature x, D(x|y) represents the joint probability value that the judger identifies the real traffic sample feature x marked with label y as true, P data (x) represents the data distribution of real traffic sample characteristics, P z (z) represents the data distribution of the characteristics of deceptive traffic samples.

[0121] In the embodiment of the present application, in each iteration, the model randomly selects m real traffic samples and m deceptive traffic samples generated by the generator to train the discriminator D, so the training of the discriminator is shown in formula (2):

[0122]

[0123] Among them, x i is the real sample, z i is the generated sample of the generator, θ d are the training parameters of the discriminator.

[0124] When training the generator G, the goal is to train a generator that can generate samples that deceive the discriminator and consume as little as possible. The calculation is shown in formula (3):

[0125]

[0126] Among them, θ g is the training parameter of the generator. When both are optimal, the charging pile intrusion traffic data generated by the adversarial generation network can be verified by the discriminator.

[0127] Optionally, the traffic intrusion prediction model includes at least: a Bi-LSTM model and a self-attention model;

[0128] The step 104 includes:

[0129] Step 1041: Input the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector.

[0130] Step 1042: input the training feature vector into the self-attention model to obtain a prediction result.

[0131] Step 1043, calculating the loss value corresponding to the prediction result.

[0132] Step 1044, when the loss value is less than the loss value threshold, confirm that the training of the traffic intrusion prediction model is completed.

[0133] Need to explain that yes. The training data set is a data set used to train the model, which contains various characteristics of network traffic, such as traffic size, source address, destination address, etc. Bi-LSTM model: Bi-LSTM (Bidirectional Long Short-Term Memory Network) is a deep learning model that is particularly suitable for processing sequence data. It can capture the front-to-back dependencies in the data and is very suitable for feature extraction in traffic intrusion detection. Self-Attention Model: The Self-Attention Model is a mechanism that allows the model to take into account other words in a sentence when processing a single word. Here, it is used to further process the feature vector extracted by Bi-LSTM to generate more accurate prediction results.

[0134] In an embodiment of the present application, after obtaining a training data set, it is necessary to perform feature extraction on the training data set, and the Bi-LSTM (bidirectional long short-term memory network) model can be used to process the training data set to extract feature vectors that can represent the characteristics of the data. The Bi-LSTM model is particularly suitable for processing sequence data, and can capture the front-end dependencies in the data, thereby extracting effective features. The training feature vector extracted from the Bi-LSTM model is input into the self-attention model. The self-attention model further processes these feature vectors and generates a prediction result, that is, it determines whether there is an intrusion in the network traffic.

[0135] The difference between the predicted result and the actual result is calculated. This difference is called the loss value. The loss value is an important indicator to measure the accuracy of model prediction. A smaller loss value means that the model's predicted result is closer to the actual result. The loss value can be calculated by the loss function shown in the following formula (4):

[0136]

[0137] in, is the model’s predicted value for the i-th sample in the charging pile traffic data set, y i is the label of the model for the i-th sample in the charging pile traffic dataset, and m is the total number of samples in the dataset.

[0138] A loss value threshold can be set to determine whether the model training results are acceptable. If the calculated loss value is greater than this threshold, it means that the prediction accuracy of the model is not high enough and further training or adjustment of model parameters is required. If the loss value is less than or equal to the threshold, the model training results can be considered acceptable and can be used for actual traffic intrusion prediction tasks.

[0139] The embodiment of the present application uses the Bi-LSTM model for feature extraction, uses the self-attention model to generate prediction results, calculates the loss value to evaluate the model performance, and confirms whether the training results meet the requirements based on the loss value. This is a typical deep learning model training process, which aims to improve the prediction accuracy of the model through continuous iteration and optimization.

[0140] Optionally, the step 1041 includes:

[0141]

[0142]

[0143] Among them, W f is the weight coefficient of the forget gate, W u is the weight coefficient of the input gate, W ois the weight coefficient of the output gate, W c is the weight coefficient of the traffic feature extraction process, b f represents the bias value of the forget gate, b u represents the bias value of the input gate, b o represents the bias value of the output gate, b c Indicates the bias value of the flow feature extraction process. h (t-1) represents the hidden state h of the model at time t-1, x (t) represents the model input at time t, and σ() represents the activation function Sigmoid. t and Both represent the state of the network node, and they represent the state of the nerve cell at time t and the temporary state of the nerve cell respectively. t is the hidden state of the model.

[0144] Optionally, the step 1042 includes:

[0145] The training feature vector is input into the following formula to obtain the prediction result:

[0146] K=W k *h t +b k ;

[0147] a t =Attention(Q,K,Vet);

[0148]

[0149] Among them, W k is the weight coefficient of feature conversion, b k Indicates the bias value of model feature transformation. a t is the output of the attention model, Vet represents the vector of input features, Q and K both represent the feature vectors for calculating the Attention weights, and W a is the weight coefficient of model feature transformation, b a Indicates the bias value of model feature transformation.

[0150] In the embodiment of the present application, the output vector h of the relevant BiLSTM is obtained. t Finally, this patent calculates the attention of the sample and generates the final prediction value through the activation function. The detection model calculates the detection probability value of the predicted sample through the attention mechanism and activation function.

[0151] Reference Figure 2,Source data, according to the detection model requirements, the traffic characteristics in the electric vehicle charging pile are extracted, such as port, IP address and other traffic characteristics and statistical characteristics of traffic packets, which include information such as the size of traffic packets, which are used for the training of charging pile traffic intrusion detection model.

[0152] Feature preprocessing: preprocess the extracted charging pile traffic feature data and normalize features such as traffic and data packets to facilitate the adversarial generation network to read the features and improve the training efficiency of the detection model.

[0153] The adversarial generative network learns the normalized data features, and the generator generates intrusion data similar to the intrusion data distribution through random noise. The discriminator then analyzes these samples, and the intrusion data passing the discriminator will be used as part of the training data.

[0154] A new data set is constructed, intrusion samples that pass through the discriminator network are aggregated, sample data is extracted in equal proportion, and a data set with a more balanced data distribution is constructed to avoid the problem of poor model detection effect caused by imbalanced sample categories.

[0155] Intrusion detection training quantifies the characteristics of traffic, detects traffic data in combination with a deep neural network model, and returns the label value of the sample. After the intrusion detection model is trained, new samples are detected and classified, and ultimately the traffic intrusion events of charging piles can be detected, thus avoiding losses in a timely and effective manner.

[0156] Reference Figure 3 , extract data from the localized charging pile traffic feature database, and import the relevant data into this system for preprocessing; the data preprocessing module identifies all application information contained in the raw data collected in the step. The module needs to first screen the charging pile traffic features, extract features such as traffic and packet data in the software, and normalize these data; the adversarial generative network module brings the preprocessed features into the adversarial generative network, and uses the generator and discriminator to generate a new intrusion data set; the newly generated data set is brought into the neural network model for calculation, and the data is characterized and predicted through the Bi-LSTM model and attention mechanism to improve the prediction accuracy of the detection model. Use the detection model to classify new charging pile intrusion samples, derive the charging pile intrusion behavior, and defend in time.

[0157] Based on the same inventive concept, the embodiment of the present application also provides a charging pile traffic intrusion detection device for implementing the above-mentioned charging pile traffic intrusion detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more charging pile traffic intrusion detection device embodiments provided below can refer to the above-mentioned limitations on the charging pile traffic intrusion detection method, which will not be repeated here.

[0158] In an exemplary embodiment, Figure 4 As shown, a charging pile flow intrusion detection device 20 is provided, comprising:

[0159] The adversarial generation network module 201 is used to input the real sample flow characteristics extracted from the electric vehicle charging pile into the generator of the adversarial generation network to obtain the deceptive sample flow characteristics;

[0160] Inputting the deceptive traffic sample features into the discriminator of the adversarial generation network for verification;

[0161] In the case where the discriminator verifies the fraudulent traffic sample feature, combining the real sample traffic feature and the fraudulent traffic sample feature into a training data set;

[0162] A model training module 202 is used to train a traffic intrusion prediction model using the training data set;

[0163] The model prediction module 203 is used to use the trained traffic intrusion prediction model to detect whether there is traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

[0164] Optionally, the generative adversarial network module 201 is further used for:

[0165] Inputting the real sample flow characteristics into a generator of a generative adversarial network so that the generator learns the characteristic distribution of the real sample quantity characteristics;

[0166] Random noise is input into the generator after learning the feature distribution to obtain the deceptive sample traffic feature.

[0167] Optionally, the generative adversarial network module 201 is further used for:

[0168] Inputting the deceptive traffic sample feature and the real sample traffic feature into the discriminator of the adversarial generation network to obtain a first probability value that the real traffic sample feature is true and a second probability value that the deceptive sample traffic feature is true;

[0169] Inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value;

[0170] When the optimization function value reaches the optimization requirement, confirming that the discriminator has passed the verification of the fraudulent traffic sample feature;

[0171] When the evaluation function value does not meet the training requirement, the discriminator continues to be trained.

[0172] Optionally, the generative adversarial network module 201 is further used for:

[0173] The first probability value and the second probability value are input into the following optimization function:

[0174]

[0175] Wherein, V(D,G) represents the optimization function, D(x) represents the first probability value that the judger identifies the real traffic sample feature x as true, 1-D(G(z)) represents the second probability value that the judger identifies the fraudulent traffic sample feature z as true, y represents the label of the real traffic sample feature x, D(x|y) represents the joint probability value that the judger identifies the real traffic sample feature x marked with label y as true, P data (x) represents the data distribution of real traffic sample characteristics, P z (z) represents the data distribution of the characteristics of deceptive traffic samples.

[0176] Optionally, the traffic intrusion prediction model includes at least: a Bi-LSTM model and a self-attention model;

[0177] The model training module 202 is also used for:

[0178] Inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector;

[0179] Inputting the training feature vector into the self-attention model to obtain a prediction result;

[0180] Calculating a loss value corresponding to the prediction result;

[0181] When the loss value is less than the loss value threshold, it is confirmed that the training of the traffic intrusion prediction model is completed.

[0182] Optionally, the model training module 202 is further used to:

[0183] The training data set is input into the following Bi-LSTM model:

[0184]

[0185] Among them, W f is the weight coefficient of the forget gate, Wu is the weight coefficient of the input gate, W o is the weight coefficient of the output gate, W c is the weight coefficient of the traffic feature extraction process, b f represents the bias value of the forget gate, b u represents the bias value of the input gate, b o represents the bias value of the output gate, b c Indicates the bias value of the flow feature extraction process. h (t-1) represents the hidden state h of the model at time t-1, x (t) represents the model input at time t, and σ() represents the activation function Sigmoid. t and Both represent the state of the network node, and they represent the state of the nerve cell at time t and the temporary state of the nerve cell respectively. t is the hidden state of the model.

[0186] Optionally, the model training module 202 is further used to:

[0187] The training feature vector is input into the following formula to obtain the prediction result:

[0188] K=W k *h t +b k ;

[0189] a t =Attention(Q,K,Vet);

[0190]

[0191] Among them, W k is the weight coefficient of feature conversion, b k Indicates the bias value of model feature transformation. a t is the output of the attention model, Vet represents the vector of input features, Q and K both represent the feature vectors for calculating the Attention weights, and W a is the weight coefficient of model feature transformation, b a Indicates the bias value of model feature transformation.

[0192] The embodiment of the present application uses the generator of the adversarial generative network to learn the real traffic sample characteristics to generate deceptive traffic sample characteristics that conform to the distribution of malicious intrusion traffic sample characteristics, and successfully passes the verification of the discriminator, thereby using the training loop composed of the generated real traffic sample characteristics and the deceptive traffic sample characteristics to train the traffic intrusion prediction model, thereby solving the current problems of less charging pile intrusion data and unbalanced data categories, ensuring the data quality of the traffic intrusion prediction model training, and improving the accuracy of the prediction of traffic intrusion behavior of electric vehicle charging piles.

[0193] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store detection data of charging pile traffic intrusion. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for detecting charging pile traffic intrusion is implemented.

[0194] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0195] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0196] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0197] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0198] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0199] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0200] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0201] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0202] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for detecting charging pile traffic intrusion, characterized in that: The detection method of charging pile traffic intrusion: The real sample traffic features extracted from the electric vehicle charging pile are input into the generator of the adversarial generation network to obtain the deceptive sample traffic features; Inputting the deceptive traffic sample features into the discriminator of the adversarial generation network for verification; In the case where the discriminator verifies the fraudulent traffic sample feature, combining the real sample traffic feature and the fraudulent traffic sample feature into a training data set; Using the training data set to train the traffic intrusion prediction model; The trained traffic intrusion prediction model is used to detect whether there is traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

2. The method for detecting charging pile traffic intrusion according to claim 1, characterized in that: The step of inputting the real sample traffic feature into the generator of the adversarial generation network to obtain the deceptive sample traffic feature includes: Inputting the real sample flow characteristics into a generator of a generative adversarial network so that the generator learns the characteristic distribution of the real sample quantity characteristics; Random noise is input into the generator after learning the feature distribution to obtain the deceptive sample traffic feature.

3. The method for detecting charging pile traffic intrusion according to claim 2, characterized in that: The step of inputting the deceptive traffic sample feature into the discriminator of the adversarial generation network for verification includes: Inputting the deceptive traffic sample feature and the real sample traffic feature into the discriminator of the adversarial generation network to obtain a first probability value that the real traffic sample feature is true and a second probability value that the deceptive sample traffic feature is true; Inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value; When the optimization function value reaches the optimization requirement, confirming that the discriminator has passed the verification of the fraudulent traffic sample feature; When the evaluation function value does not meet the training requirement, the discriminator continues to be trained.

4. The method for detecting charging pile traffic intrusion according to claim 3, characterized in that: The step of inputting the first probability value and the second probability value into an optimization function to obtain an optimization function value comprises: The first probability value and the second probability value are input into the following optimization function: Wherein, V(D,G) represents the optimization function, D(x) represents the first probability value that the judger identifies the real traffic sample feature x as true, 1-D(G(z)) represents the second probability value that the judger identifies the fraudulent traffic sample feature z as true, y represents the label of the real traffic sample feature x, D(x|y) represents the joint probability value that the judger identifies the real traffic sample feature x marked with label y as true, P data (x) represents the data distribution of real traffic sample characteristics, P z (z) represents the data distribution of the characteristics of deceptive traffic samples.

5. The method for detecting charging pile traffic intrusion according to claim 1, characterized in that: The traffic intrusion prediction model at least includes: a Bi-LSTM model and a self-attention model; The step of training the traffic intrusion prediction model using the training data set includes: Inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector; Inputting the training feature vector into the self-attention model to obtain a prediction result; Calculating a loss value corresponding to the prediction result; When the loss value is less than the loss value threshold, it is confirmed that the training of the traffic intrusion prediction model is completed.

6. The method for detecting charging pile traffic intrusion according to claim 5, characterized in that: The step of inputting the training data set into the Bi-LSTM model for feature extraction to obtain a training feature vector includes: The training data set is input into the following Bi-LSTM model: Among them, W f is the weight coefficient of the forget gate, W u is the weight coefficient of the input gate, W o is the weight coefficient of the output gate, W c is the weight coefficient of the traffic feature extraction process, b f represents the bias value of the forget gate, b u represents the bias value of the input gate, b o represents the bias value of the output gate, b c Indicates the bias value of the flow feature extraction process; h (t-1) represents the hidden state h of the model at time t-1, x (t) represents the model input at time t, σ() represents the activation function Sigmoid; c t and Both represent the state of the network node, and they represent the state of the nerve cell at time t and the temporary state of the nerve cell respectively; h t is the hidden state of the model.

7. The method for detecting charging pile traffic intrusion according to claim 5, characterized in that: The step of inputting the training feature vector into the self-attention model to obtain a prediction result comprises: The training feature vector is input into the following formula to obtain the prediction result: K=W k *h t +b k ; a t =Attention(Q,K,Vet); Among them, W k is the weight coefficient of feature conversion, b k Indicates the bias value of model feature transformation, a t is the output of the attention model, Vet represents the vector of input features, Q and K both represent the feature vectors for calculating the Attention weights, and W a is the weight coefficient of model feature transformation, b a Indicates the bias value of model feature transformation.

8. A charging pile flow intrusion detection device, characterized in that: The charging pile flow intrusion detection device comprises: The adversarial generative network module is used to input the real sample traffic features extracted from the electric vehicle charging pile into the generator of the adversarial generative network to obtain the deceptive sample traffic features; Inputting the deceptive traffic sample features into the discriminator of the adversarial generation network for verification; In the case where the discriminator verifies the fraudulent traffic sample feature, combining the real sample traffic feature and the fraudulent traffic sample feature into a training data set; A model training module, used to train a traffic intrusion prediction model using the training data set; The model prediction module is used to use the trained traffic intrusion prediction model to detect whether there is traffic intrusion behavior in the data traffic of the electric vehicle charging pile.

9. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for detecting charging pile traffic intrusion described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for detecting charging pile flow intrusion described in any one of claims 1-7 are implemented.

Images